Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Build.exe

Overview

General Information

Sample name:Build.exe
Analysis ID:1639402
MD5:7c77b3c5e87cd408d0565c369a4d9e2f
SHA1:071767bbb20bc1a134c983e9259b1734973faf87
SHA256:970dd08b78f4db8373c1f5965ebfa179174783ee2d31024c74219bcff97a4749
Tags:exeStormKittyuser-aachum
Infos:

Detection

StormKitty
Score:100
Range:0 - 100
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Attempt to bypass Chrome Application-Bound Encryption
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Capture Wi-Fi password
Yara detected Generic Stealer
Yara detected StormKitty Stealer
.NET source code references suspicious native API functions
Contains functionality to capture screen (.Net source)
Found many strings related to Crypto-Wallets (likely being stolen)
Joe Sandbox ML detected suspicious sample
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal WLAN passwords
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses netsh to modify the Windows network and firewall settings
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to call native functions
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries information about the installed CPU (vendor, model number etc)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Browser Started with Remote Debugging
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

  • System is w10x64
  • Build.exe (PID: 6924 cmdline: "C:\Users\user\Desktop\Build.exe" MD5: 7C77B3C5E87CD408D0565C369A4D9E2F)
    • cmd.exe (PID: 6208 cmdline: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 5192 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • chcp.com (PID: 6444 cmdline: chcp 65001 MD5: 20A59FB950D8A191F7D35C4CA7DA9CAF)
      • netsh.exe (PID: 6488 cmdline: netsh wlan show profile MD5: 4E89A1A088BE715D6C946E55AB07C7DF)
      • findstr.exe (PID: 5168 cmdline: findstr All MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)
    • cmd.exe (PID: 5816 cmdline: "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 5232 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • chcp.com (PID: 4400 cmdline: chcp 65001 MD5: 20A59FB950D8A191F7D35C4CA7DA9CAF)
      • netsh.exe (PID: 5792 cmdline: netsh wlan show networks mode=bssid MD5: 4E89A1A088BE715D6C946E55AB07C7DF)
    • chrome.exe (PID: 4372 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default" MD5: E81F54E6C1129887AEA47E7D092680BF)
      • chrome.exe (PID: 5792 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1964,i,11247005369938527612,18363969163184259848,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2136 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
Cameleon, StormKittyPWC describes this malware as a backdoor, capable of file management, upload and download of files, and execution of commands.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.cameleon
No configs have been found
SourceRuleDescriptionAuthorStrings
Build.exeJoeSecurity_StormKittyYara detected StormKitty StealerJoe Security
    Build.exeJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
      Build.exeinfostealer_win_stormkittyFinds StormKitty samples (or their variants) based on specific stringsSekoia.io
      • 0x15157:$sk01: LimerBoy/StormKitty
      • 0x2336c:$str01: set_sUsername
      • 0x235e2:$str02: set_sIsSecure
      • 0x24222:$str03: set_sExpMonth
      • 0x259ce:$str04: WritePasswords
      • 0x25c2b:$str05: WriteCookies
      • 0x26149:$str06: sChromiumPswPaths
      • 0x26119:$str07: sGeckoBrowserPaths
      • 0x280a6:$str08: Username: {1}
      • 0x28979:$str08: Username: {1}
      • 0x280c2:$str09: Password: {2}
      • 0x28995:$str09: Password: {2}
      • 0x291ce:$str10: encrypted_key":"(.*?)"
      Build.exeINDICATOR_SUSPICIOUS_EXE_Discord_RegexDetects executables referencing Discord tokens regular expressionsditekSHen
      • 0x2b676:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}|mfa\.[a-zA-Z0-9_\-]{84}
      Build.exeINDICATOR_SUSPICIOUS_EXE_References_VPNDetects executables referencing many VPN software clients. Observed in infosteslersditekSHen
      • 0x29090:$s1: \VPN\NordVPN
      • 0x29076:$s2: \VPN\OpenVPN
      • 0x29058:$s3: \VPN\ProtonVPN
      Click to see the 2 entries
      SourceRuleDescriptionAuthorStrings
      00000000.00000002.1016471941.0000000007DFC000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_GenericStealer_9Yara detected Generic StealerJoe Security
        00000000.00000000.841274944.00000000007D2000.00000002.00000001.01000000.00000003.sdmpJoeSecurity_StormKittyYara detected StormKitty StealerJoe Security
          00000000.00000000.841274944.00000000007D2000.00000002.00000001.01000000.00000003.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
            00000000.00000000.841274944.00000000007D2000.00000002.00000001.01000000.00000003.sdmpINDICATOR_SUSPICIOUS_EXE_Discord_RegexDetects executables referencing Discord tokens regular expressionsditekSHen
            • 0x2b476:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}|mfa\.[a-zA-Z0-9_\-]{84}
            00000000.00000002.1008445716.0000000002B6B000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_StormKittyYara detected StormKitty StealerJoe Security
              Click to see the 6 entries
              SourceRuleDescriptionAuthorStrings
              0.0.Build.exe.7d0000.0.unpackJoeSecurity_StormKittyYara detected StormKitty StealerJoe Security
                0.0.Build.exe.7d0000.0.unpackJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
                  0.0.Build.exe.7d0000.0.unpackinfostealer_win_stormkittyFinds StormKitty samples (or their variants) based on specific stringsSekoia.io
                  • 0x15157:$sk01: LimerBoy/StormKitty
                  • 0x2336c:$str01: set_sUsername
                  • 0x235e2:$str02: set_sIsSecure
                  • 0x24222:$str03: set_sExpMonth
                  • 0x259ce:$str04: WritePasswords
                  • 0x25c2b:$str05: WriteCookies
                  • 0x26149:$str06: sChromiumPswPaths
                  • 0x26119:$str07: sGeckoBrowserPaths
                  • 0x280a6:$str08: Username: {1}
                  • 0x28979:$str08: Username: {1}
                  • 0x280c2:$str09: Password: {2}
                  • 0x28995:$str09: Password: {2}
                  • 0x291ce:$str10: encrypted_key":"(.*?)"
                  0.0.Build.exe.7d0000.0.unpackINDICATOR_SUSPICIOUS_EXE_Discord_RegexDetects executables referencing Discord tokens regular expressionsditekSHen
                  • 0x2b676:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}|mfa\.[a-zA-Z0-9_\-]{84}
                  0.0.Build.exe.7d0000.0.unpackINDICATOR_SUSPICIOUS_EXE_References_VPNDetects executables referencing many VPN software clients. Observed in infosteslersditekSHen
                  • 0x29090:$s1: \VPN\NordVPN
                  • 0x29076:$s2: \VPN\OpenVPN
                  • 0x29058:$s3: \VPN\ProtonVPN
                  Click to see the 2 entries

                  System Summary

                  barindex
                  Source: Process startedAuthor: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\Build.exe", ParentImage: C:\Users\user\Desktop\Build.exe, ParentProcessId: 6924, ParentProcessName: Build.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default", ProcessId: 4372, ProcessName: chrome.exe

                  Stealing of Sensitive Information

                  barindex
                  Source: Process startedAuthor: Joe Security: Data: Command: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, CommandLine: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\Build.exe", ParentImage: C:\Users\user\Desktop\Build.exe, ParentProcessId: 6924, ParentProcessName: Build.exe, ProcessCommandLine: "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All, ProcessId: 6208, ProcessName: cmd.exe
                  No Suricata rule has matched

                  Click to jump to signature section

                  Show All Signature Results

                  AV Detection

                  barindex
                  Source: Build.exeAvira: detected
                  Source: Build.exeVirustotal: Detection: 73%Perma Link
                  Source: Build.exeReversingLabs: Detection: 80%
                  Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                  Source: C:\Users\user\Desktop\Build.exeCode function: 0_2_04B05F48 CryptUnprotectData,0_2_04B05F48
                  Source: C:\Users\user\Desktop\Build.exeCode function: 0_2_04B05F41 CryptUnprotectData,0_2_04B05F41
                  Source: Build.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                  Source: unknownHTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.7:49681 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.26.0.100:443 -> 192.168.2.7:49682 version: TLS 1.2
                  Source: Build.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                  Source: chrome.exeMemory has grown: Private usage: 1MB later: 32MB
                  Source: global trafficTCP traffic: 192.168.2.7:49699 -> 23.94.126.116:9000
                  Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /v1/ip/geo.json HTTP/1.1Host: get.geojs.ioConnection: Keep-Alive
                  Source: Joe Sandbox ViewIP Address: 34.117.59.81 34.117.59.81
                  Source: Joe Sandbox ViewIP Address: 34.117.59.81 34.117.59.81
                  Source: Joe Sandbox ViewIP Address: 104.26.0.100 104.26.0.100
                  Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.94.126.116
                  Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /v1/ip/geo.json HTTP/1.1Host: get.geojs.ioConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiKo8sBCIWgzQEI9s/OAQiA1s4BCMnczgEIhODOAQii5M4BCK/kzgEI6eTOAQ==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
                  Source: global trafficHTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiKo8sBCIWgzQEI9s/OAQiA1s4BCMnczgEIhODOAQii5M4BCK/kzgEI6eTOAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
                  Source: global trafficHTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
                  Source: chrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
                  Source: chrome.exe, 0000000A.00000003.966831567.00004C4400778000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: :0,"tiHedule_:true,"first_session_service":true,"tab_count":1,"time":"13385827782348048","type":2,"window_count":1}],"session_data_status":3},"settings":{"a11y":{"apply_page_colors_only_on_increased_contrast":true},"force_google_safesearch":false},"should_read_incoming_syncing_theme_prefs":true,"signin":{"allowed":true,"cookie_clear_on_exit_migration_notice_complete":true},"spellcheck":{"dictionaries":["en-US"],"dictionary":""},"supervised_user":{"metrics":{"day_id":154408}},"sync":{"autofill_wallet_import_enabled_migrated":true,"data_type_status_for_sync_to_signin":{"app_list":false,"app_settings":false,"apps":false,"arc_package":false,"autofill":false,"autofill_profiles":false,"autofill_wallet":false,"autofill_wallet_credential":false,"autofill_wallet_metadata":false,"autofill_wallet_offer":false,"autofill_wallet_usage":false,"bookmarks":false,"collaboration_group":false,"contact_info":false,"cookies":false,"device_info":false,"dictionary":false,"extension_settings":false,"extensions":false,"history":false,"history_delete_directives":false,"incoming_password_sharing_invitation":false,"managed_user_settings":false,"nigori":false,"os_preferences":false,"os_priority_preferences":false,"outgoing_password_sharing_invitation":false,"passwords":false,"plus_address":false,"plus_address_setting":false,"power_bookmark":false,"preferences":false,"printers":false,"printers_authorization_servers":false,"priority_preferences":false,"product_comparison":false,"reading_list":false,"saved_tab_group":false,"search_engines":false,"security_events":false,"send_tab_to_self":false,"sessions":false,"shared_tab_group_data":false,"sharing_message":false,"themes":false,"user_consent":false,"user_events":false,"web_apps":false,"webapks":false,"webauthn_credential":false,"wifi_configurations":false,"workspace_desk":false},"encryption_bootstrap_token_per_account_migration_done":true,"feature_status_for_sync_to_signin":5,"passwords_per_account_pref_migration_done":true,"requested":false},"tab_group_saves_ui_update_migrated":true,"toolbar":{"pinned_chrome_labs_migration_complete":true},"translate_site_blacklist":[],"translate_site_blocklist_with_time":{},"updateclientdata":{"apps":{"nmmhkkegccagdldgiimedpiccmgmieda":{"cohort":"1::","cohortname":"","dlrc":6640,"installdate":6640,"pf":"50b70b56-f9a8-488a-9bd0-bef34289ee8e"}}},"web_app":{"app_id":{"install_url":{"aghbiahbpaijignceidepookljebhfak":["https://drive.google.com/drive/installwebapp?usp=chrome_default"],"agimnkijcaahngcdmfeangaknmldooml":["https://www.youtube.com/s/notifications/manifest/cr_install.html"],"fhihpiojkbmbpdjeoajapmgkhlnakfjf":["https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default"],"fmgjjmmmlfnkbppncabfkddbjimcfncm":["https://mail.google.com/mail/installwebapp?usp=chrome_default"],"kefjledonklijopmnomlcbpllchaibag":["https://docs.google.com/presentation/installwebapp?usp=chrome_default"],"mpnpojknpmmopombnjdcgaaiekajbnjb":["https://docs.google.com/document/installwebapp?usp=chrome_defaul
                  Source: chrome.exe, 0000000A.00000003.966831567.00004C4400778000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: :true,"first_session_service":true,"tab_count":1,"time":"13385827782348048","type":2,"window_count":1}],"session_data_status":3},"settings":{"a11y":{"apply_page_colors_only_on_increased_contrast":true},"force_google_safesearch":false},"should_read_incoming_syncing_theme_prefs":true,"signin":{"allowed":true,"cookie_clear_on_exit_migration_notice_complete":true},"spellcheck":{"dictionaries":["en-US"],"dictionary":""},"supervised_user":{"metrics":{"day_id":154408}},"sync":{"autofill_wallet_import_enabled_migrated":true,"data_type_status_for_sync_to_signin":{"app_list":false,"app_settings":false,"apps":false,"arc_package":false,"autofill":false,"autofill_profiles":false,"autofill_wallet":false,"autofill_wallet_credential":false,"autofill_wallet_metadata":false,"autofill_wallet_offer":false,"autofill_wallet_usage":false,"bookmarks":false,"collaboration_group":false,"contact_info":false,"cookies":false,"device_info":false,"dictionary":false,"extension_settings":false,"extensions":false,"history":false,"history_delete_directives":false,"incoming_password_sharing_invitation":false,"managed_user_settings":false,"nigori":false,"os_preferences":false,"os_priority_preferences":false,"outgoing_password_sharing_invitation":false,"passwords":false,"plus_address":false,"plus_address_setting":false,"power_bookmark":false,"preferences":false,"printers":false,"printers_authorization_servers":false,"priority_preferences":false,"product_comparison":false,"reading_list":false,"saved_tab_group":false,"search_engines":false,"security_events":false,"send_tab_to_self":false,"sessions":false,"shared_tab_group_data":false,"sharing_message":false,"themes":false,"user_consent":false,"user_events":false,"web_apps":false,"webapks":false,"webauthn_credential":false,"wifi_configurations":false,"workspace_desk":false},"encryption_bootstrap_token_per_account_migration_done":true,"feature_status_for_sync_to_signin":5,"passwords_per_account_pref_migration_done":true,"requested":false},"tab_group_saves_ui_update_migrated":true,"toolbar":{"pinned_chrome_labs_migration_complete":true},"translate_site_blacklist":[],"translate_site_blocklist_with_time":{},"updateclientdata":{"apps":{"nmmhkkegccagdldgiimedpiccmgmieda":{"cohort":"1::","cohortname":"","dlrc":6640,"installdate":6640,"pf":"50b70b56-f9a8-488a-9bd0-bef34289ee8e"}}},"web_app":{"app_id":{"install_url":{"aghbiahbpaijignceidepookljebhfak":["https://drive.google.com/drive/installwebapp?usp=chrome_default"],"agimnkijcaahngcdmfeangaknmldooml":["https://www.youtube.com/s/notifications/manifest/cr_install.html"],"fhihpiojkbmbpdjeoajapmgkhlnakfjf":["https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default"],"fmgjjmmmlfnkbppncabfkddbjimcfncm":["https://mail.google.com/mail/installwebapp?usp=chrome_default"],"kefjledonklijopmnomlcbpllchaibag":["https://docs.google.com/presentation/installwebapp?usp=chrome_default"],"mpnpojknpmmopombnjdcgaaiekajbnjb":["https://docs.google.com/document/installwebapp?usp=chrome_default"]}}},"web_a
                  Source: chrome.exe, 0000000A.00000003.983970958.00004C4400334000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: <!--_html_template_end_-->`}const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends CrLitElement{constructor(){super(...arguments);this.url={url:""}}static get is(){return"ntp-doodle-share-dialog"}static get styles(){return getCss$2()}render(){return getHtml$2.bind(this)()}static get properties(){return{title:{type:String},url:{type:Object}}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.fire("share",channel)}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);let instance$3=null;function getCss$1(){return instance$3||(instance$3=[...[getCss$4()],css`:host{--ntp-logo-height:168px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#doodle{position:relative}#shareButton{background-color:var(--color-new-tab-page-doodle-share-button-background,none);border:none;height:32px;min-width:32px;padding:0;position:absolute;width:32px;bottom:0}:host-context([dir=ltr]) #shareButton{right:-40px}:host-context([dir=rtl]) #shareButton{left:-40px}#shareButtonIcon{width:18px;height:18px;margin:7px;vertical-align:bottom;mask-image:url(chrome://new-tab-page/icons/share_unfilled.svg);background-color:var(--color-new-tab-page-doodle-share-button-i
                  Source: chrome.exe, 0000000A.00000003.983970958.00004C4400334000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: <!--_html_template_end_-->`}const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends CrLitElement{constructor(){super(...arguments);this.url={url:""}}static get is(){return"ntp-doodle-share-dialog"}static get styles(){return getCss$2()}render(){return getHtml$2.bind(this)()}static get properties(){return{title:{type:String},url:{type:Object}}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.fire("share",channel)}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);let instance$3=null;function getCss$1(){return instance$3||(instance$3=[...[getCss$4()],css`:host{--ntp-logo-height:168px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#doodle{position:relative}#shareButton{background-color:var(--color-new-tab-page-doodle-share-button-background,none);border:none;height:32px;min-width:32px;padding:0;position:absolute;width:32px;bottom:0}:host-context([dir=ltr]) #shareButton{right:-40px}:host-context([dir=rtl]) #shareButton{left:-40px}#shareButtonIcon{width:18px;height:18px;margin:7px;vertical-align:bottom;mask-image:url(chrome://new-tab-page/icons/share_unfilled.svg);background-color:var(--color-new-tab-page-doodle-share-button-i
                  Source: chrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
                  Source: chrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
                  Source: chrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
                  Source: chrome.exe, 0000000A.00000002.1019108684.00004C4400450000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
                  Source: global trafficDNS traffic detected: DNS query: ipinfo.io
                  Source: global trafficDNS traffic detected: DNS query: 144.48.8.0.in-addr.arpa
                  Source: global trafficDNS traffic detected: DNS query: get.geojs.io
                  Source: global trafficDNS traffic detected: DNS query: www.google.com
                  Source: chrome.exe, 0000000A.00000002.1018210431.00004C440021C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://clients2.google.com/time/1/current
                  Source: chrome.exe, 0000000A.00000002.1021481827.00004C4400958000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=134
                  Source: chrome.exe, 0000000A.00000002.1020393435.00004C44007BC000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1021212107.00004C44008EC000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1021315248.00004C4400928000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://developer.chrome.com/docs/extensions/how-to/distribute/install-extensions)
                  Source: chrome.exe, 0000000A.00000002.1023812196.00004C4401068000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://dns-tunnel-check.googlezip.net/connect
                  Source: chrome.exe, 0000000A.00000002.1017082825.00004C440008A000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://google.com/
                  Source: chrome.exe, 0000000A.00000002.1017447012.00004C4400138000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1007502580.000002D4C7657000.00000004.10000000.00040000.00000000.sdmp, chrome.exe, 0000000A.00000002.1017816259.00004C44001C4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUw
                  Source: Build.exe, 00000000.00000002.1008445716.0000000002AF1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                  Source: chrome.exe, 0000000A.00000002.1023060403.00004C4400DBC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://unisolated.invalid/
                  Source: chrome.exe, 0000000A.00000002.1017447012.00004C4400138000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/update2/response
                  Source: chrome.exe, 0000000A.00000002.1023091803.00004C4400DD4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.gstatic.com/generate_204
                  Source: chrome.exe, 0000000A.00000002.989461393.000002D4C4866000.00000002.00000001.00040000.0000000E.sdmpString found in binary or memory: http://www.unicode.org/copyright.html
                  Source: tmpFBCD.tmp.dat.0.drString found in binary or memory: https://ac.ecosia.org?q=
                  Source: chrome.exe, 0000000A.00000002.1018544365.00004C4400244000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accountcapabilities-pa.googleapis.com/
                  Source: chrome.exe, 0000000A.00000002.1016967319.00004C4400038000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
                  Source: chrome.exe, 0000000A.00000002.1026571124.00004C44016EC000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1020115422.00004C4400730000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.966831567.00004C4400778000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com
                  Source: chrome.exe, 0000000A.00000002.1018210431.00004C440021C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1026571124.00004C44016EC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/
                  Source: chrome.exe, 0000000A.00000002.1018544365.00004C4400244000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/AccountChooser
                  Source: chrome.exe, 0000000A.00000002.1018210431.00004C440021C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/AddSession
                  Source: chrome.exe, 0000000A.00000002.1018544365.00004C4400244000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
                  Source: chrome.exe, 0000000A.00000002.1018544365.00004C4400244000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
                  Source: chrome.exe, 0000000A.00000002.1018544365.00004C4400244000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/Logout
                  Source: chrome.exe, 0000000A.00000002.1018210431.00004C440021C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/RotateBoundCookies
                  Source: chrome.exe, 0000000A.00000002.1018659498.00004C4400302000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
                  Source: chrome.exe, 0000000A.00000002.1018659498.00004C44002E8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
                  Source: chrome.exe, 0000000A.00000002.1018659498.00004C44002E8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/fine-allowlist
                  Source: chrome.exe, 0000000A.00000002.1018210431.00004C440021C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/chrome/blank.html
                  Source: chrome.exe, 0000000A.00000002.1018544365.00004C4400244000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
                  Source: chrome.exe, 0000000A.00000002.1018544365.00004C4400244000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
                  Source: chrome.exe, 0000000A.00000002.1018544365.00004C4400244000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
                  Source: chrome.exe, 0000000A.00000002.1018544365.00004C4400244000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
                  Source: chrome.exe, 0000000A.00000002.1018544365.00004C4400244000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
                  Source: chrome.exe, 0000000A.00000002.1018544365.00004C4400244000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/setup/windows
                  Source: chrome.exe, 0000000A.00000002.1018544365.00004C4400244000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
                  Source: chrome.exe, 0000000A.00000002.1018544365.00004C4400244000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
                  Source: chrome.exe, 0000000A.00000002.1017149597.00004C4400094000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
                  Source: chrome.exe, 0000000A.00000002.1018210431.00004C440021C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/o/oauth2/revoke
                  Source: chrome.exe, 0000000A.00000002.1018210431.00004C440021C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/oauth/multilogin
                  Source: chrome.exe, 0000000A.00000002.1018544365.00004C4400244000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/samlredirect
                  Source: chrome.exe, 0000000A.00000002.1018544365.00004C4400244000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
                  Source: chrome.exe, 0000000A.00000002.1020115422.00004C4400730000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com:443
                  Source: chrome.exe, 0000000A.00000002.1023258674.00004C4400E24000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apis.google.com
                  Source: chrome.exe, 0000000A.00000002.1021481827.00004C4400958000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://blog.google/products/chrome/google-chrome-safe-browsing-real-time/
                  Source: chrome.exe, 0000000A.00000003.984049715.00004C44014B0000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1019634698.00004C4400594000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1026080342.00004C4401450000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.983903958.00004C4401490000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://calendar.google.com
                  Source: chrome.exe, 0000000A.00000002.1022719613.00004C4400C7C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1022330657.00004C4400B18000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1025923848.00004C44013E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
                  Source: tmpFBCD.tmp.dat.0.drString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
                  Source: Build.exe, 00000000.00000002.1008759243.0000000003C8D000.00000004.00000800.00020000.00000000.sdmp, Build.exe, 00000000.00000002.1008759243.0000000003CAF000.00000004.00000800.00020000.00000000.sdmp, Build.exe, 00000000.00000002.1008759243.0000000003CD1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1023030617.00004C4400DA4000.00000004.00001000.00020000.00000000.sdmp, tmpFBCD.tmp.dat.0.drString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
                  Source: Build.exe, 00000000.00000002.1008759243.0000000003C8D000.00000004.00000800.00020000.00000000.sdmp, Build.exe, 00000000.00000002.1008759243.0000000003CAF000.00000004.00000800.00020000.00000000.sdmp, Build.exe, 00000000.00000002.1008759243.0000000003CD1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1023030617.00004C4400DA4000.00000004.00001000.00020000.00000000.sdmp, tmpFBCD.tmp.dat.0.drString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
                  Source: chrome.exe, 0000000A.00000003.967261174.00004C4401384000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore
                  Source: chrome.exe, 0000000A.00000002.989206046.000002D4C3C70000.00000002.00000001.00040000.0000000D.sdmpString found in binary or memory: https://chrome.google.com/webstore/category/extensions
                  Source: chrome.exe, 0000000A.00000002.1008602756.000002D4C7D37000.00000004.10000000.00040000.00000000.sdmp, chrome.exe, 0000000A.00000002.1023091803.00004C4400DD4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=en
                  Source: chrome.exe, 0000000A.00000002.989206046.000002D4C3C70000.00000002.00000001.00040000.0000000D.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=en&category=theme81https://myactivity.google.com/myactivity/?u
                  Source: chrome.exe, 0000000A.00000002.989206046.000002D4C3C70000.00000002.00000001.00040000.0000000D.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=enCtrl$1
                  Source: chrome.exe, 0000000A.00000003.967073494.00004C440118E000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1024338114.00004C4401198000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.967073494.00004C4401188000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.967261174.00004C4401384000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstoreLDDiscover
                  Source: chrome.exe, 0000000A.00000002.989206046.000002D4C3C70000.00000002.00000001.00040000.0000000D.sdmpString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherEnabled
                  Source: chrome.exe, 0000000A.00000002.989206046.000002D4C3C70000.00000002.00000001.00040000.0000000D.sdmpString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl
                  Source: chrome.exe, 0000000A.00000002.989206046.000002D4C3C70000.00000002.00000001.00040000.0000000D.sdmpString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl
                  Source: chrome.exe, 0000000A.00000002.989206046.000002D4C3C70000.00000002.00000001.00040000.0000000D.sdmpString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist
                  Source: chrome.exe, 0000000A.00000002.989206046.000002D4C3C70000.00000002.00000001.00040000.0000000D.sdmpString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlList
                  Source: chrome.exe, 0000000A.00000002.989206046.000002D4C3C70000.00000002.00000001.00040000.0000000D.sdmpString found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist
                  Source: chrome.exe, 0000000A.00000003.944660819.00004C4000504000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chromekanonymity-pa.googleapis.com/
                  Source: chrome.exe, 0000000A.00000003.944272305.00004C4000404000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.951011254.00004C4000622000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1016721175.00004C4000624000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
                  Source: chrome.exe, 0000000A.00000003.944660819.00004C4000504000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
                  Source: chrome.exe, 0000000A.00000003.944272305.00004C4000404000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.951011254.00004C4000622000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1016721175.00004C4000624000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
                  Source: chrome.exe, 0000000A.00000003.944528702.00004C40004D0000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.944634807.00004C40004E0000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.944479793.00004C40004CC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
                  Source: chrome.exe, 0000000A.00000003.944272305.00004C4000404000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.951011254.00004C4000622000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1016721175.00004C4000624000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
                  Source: chrome.exe, 0000000A.00000002.1020322402.00004C4400790000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chromemodelexecution-pa.googleapis.com/v1:Execute?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNh
                  Source: chrome.exe, 0000000A.00000002.1020322402.00004C4400790000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chromemodelquality-pa.googleapis.com/v1:LogAiData?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNh
                  Source: chrome.exe, 0000000A.00000002.1018544365.00004C4400244000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
                  Source: chrome.exe, 0000000A.00000002.1018544365.00004C4400244000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
                  Source: chrome.exe, 0000000A.00000002.989206046.000002D4C3C70000.00000002.00000001.00040000.0000000D.sdmpString found in binary or memory: https://chromestatus.com/features#browsers.chrome.status%3A%22Deprecated%22
                  Source: chrome.exe, 0000000A.00000002.1017754259.00004C4400194000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chromewebstore.google.com/
                  Source: chrome.exe, 0000000A.00000002.1021655808.00004C44009CC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chromewebstore.google.com/category/extensions
                  Source: chrome.exe, 0000000A.00000002.1021655808.00004C44009CC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chromewebstore.google.com/category/themes
                  Source: chrome.exe, 0000000A.00000002.1018544365.00004C4400244000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://classroom.googleapis.com/
                  Source: chrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://clients2.goog
                  Source: chrome.exe, 0000000A.00000003.937473783.00001BA8000DC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://clients2.google.com/cr/report
                  Source: chrome.exe, 0000000A.00000002.1017724734.00004C4400184000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1017754259.00004C4400194000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1021212107.00004C44008EC000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1020709013.00004C4400804000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1023904908.00004C44010C0000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1021458309.00004C4400948000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://clients2.google.com/service/update2/crx
                  Source: chrome.exe, 0000000A.00000002.1007502580.000002D4C7657000.00000004.10000000.00040000.00000000.sdmpString found in binary or memory: https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod
                  Source: chrome.exe, 0000000A.00000002.1020709013.00004C4400804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
                  Source: chrome.exe, 0000000A.00000002.1020709013.00004C4400804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
                  Source: chrome.exe, 0000000A.00000002.1020709013.00004C4400804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
                  Source: chrome.exe, 0000000A.00000002.1018544365.00004C4400244000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://clients4.google.com/chrome-sync
                  Source: chrome.exe, 0000000A.00000002.1018544365.00004C4400244000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://clients4.google.com/chrome-sync/event
                  Source: chrome.exe, 0000000A.00000002.1023443038.00004C4400EC8000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1021481827.00004C4400958000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=134
                  Source: chrome.exe, 0000000A.00000002.1007502580.000002D4C765D000.00000004.10000000.00040000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/clientupdate-aus/1
                  Source: chrome.exe, 0000000A.00000002.1017663274.00004C4400168000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/clientupdate-aus/1Cache-Control:
                  Source: chrome.exe, 0000000A.00000002.1027106711.00004C44017E8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/gws/cdt1
                  Source: chrome.exe, 0000000A.00000002.1027106711.00004C44017E8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/gws/cdt1Cross-Origin-Opener-Policy:
                  Source: chrome.exe, 0000000A.00000002.1027106711.00004C44017E8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/cdt1
                  Source: chrome.exe, 0000000A.00000002.1007502580.000002D4C765D000.00000004.10000000.00040000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/none
                  Source: chrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/:
                  Source: chrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
                  Source: chrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/J
                  Source: chrome.exe, 0000000A.00000003.944272305.00004C4000404000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.951011254.00004C4000622000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1016721175.00004C4000624000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview2K
                  Source: chrome.exe, 0000000A.00000003.966831567.00004C4400778000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
                  Source: chrome.exe, 0000000A.00000002.1022719613.00004C4400C7C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1022330657.00004C4400B18000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1025923848.00004C44013E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
                  Source: chrome.exe, 0000000A.00000002.1022719613.00004C4400C7C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1022330657.00004C4400B18000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1025923848.00004C44013E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
                  Source: chrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/presentation/:
                  Source: chrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
                  Source: chrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/presentation/J
                  Source: chrome.exe, 0000000A.00000003.966831567.00004C4400778000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
                  Source: chrome.exe, 0000000A.00000002.1022719613.00004C4400C7C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1022330657.00004C4400B18000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1025923848.00004C44013E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
                  Source: chrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/spreadsheets/:
                  Source: chrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
                  Source: chrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/spreadsheets/J
                  Source: chrome.exe, 0000000A.00000003.966831567.00004C4400778000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
                  Source: chrome.exe, 0000000A.00000002.1022719613.00004C4400C7C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1022330657.00004C4400B18000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1025923848.00004C44013E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
                  Source: chrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/:
                  Source: chrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/?lfhs=2
                  Source: chrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/J
                  Source: chrome.exe, 0000000A.00000003.966831567.00004C4400778000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
                  Source: tmpFBCD.tmp.dat.0.drString found in binary or memory: https://duckduckgo.com/ac/?q=
                  Source: Build.exe, 00000000.00000002.1008759243.0000000003C8D000.00000004.00000800.00020000.00000000.sdmp, Build.exe, 00000000.00000002.1008759243.0000000003CAF000.00000004.00000800.00020000.00000000.sdmp, Build.exe, 00000000.00000002.1008759243.0000000003CD1000.00000004.00000800.00020000.00000000.sdmp, tmpFBCD.tmp.dat.0.drString found in binary or memory: https://duckduckgo.com/chrome_newtabv20
                  Source: tmpFBCD.tmp.dat.0.drString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
                  Source: chrome.exe, 0000000A.00000002.1026303313.00004C4401604000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.984462771.00004C4401504000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.984388827.00004C44015B8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://fonts.google.com/icons?selected=Material
                  Source: tmpFBCD.tmp.dat.0.drString found in binary or memory: https://gemini.google.com/app?q=
                  Source: chrome.exe, 0000000A.00000003.944272305.00004C4000404000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.951011254.00004C4000622000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1016721175.00004C4000624000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gemini.google.com/glic/intro?20
                  Source: chrome.exe, 0000000A.00000003.944272305.00004C4000404000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.951011254.00004C4000622000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1016721175.00004C4000624000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gemini.google.com/glic2
                  Source: Build.exe, 00000000.00000002.1008445716.0000000002B6B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://get.geojs.io
                  Source: Build.exe, 00000000.00000002.1008445716.0000000002B6B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://get.geojs.io/v1/ip/geo.json
                  Source: Build.exeString found in binary or memory: https://get.geojs.io/v1/ip/geo.json=SELECT
                  Source: Build.exeString found in binary or memory: https://github.com/LimerBoy/StormKitty
                  Source: Build.exe, 00000000.00000002.1008445716.0000000002B6B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/LimerBoy/StormKitty0&
                  Source: chrome.exe, 0000000A.00000003.944634807.00004C40004E0000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.944479793.00004C40004CC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
                  Source: chrome.exe, 0000000A.00000003.944272305.00004C4000404000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.951011254.00004C4000622000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1016721175.00004C4000624000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
                  Source: chrome.exe, 0000000A.00000003.944479793.00004C40004CC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/https://google-ohttp-relay-join.fastly-edge.com/
                  Source: chrome.exe, 0000000A.00000003.944479793.00004C40004CC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
                  Source: chrome.exe, 0000000A.00000003.944272305.00004C4000404000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.951011254.00004C4000622000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1016721175.00004C4000624000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
                  Source: chrome.exe, 0000000A.00000003.944479793.00004C40004CC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
                  Source: chrome.exe, 0000000A.00000003.944479793.00004C40004CC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Pre
                  Source: chrome.exe, 0000000A.00000003.944479793.00004C40004CC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
                  Source: chrome.exe, 0000000A.00000002.1016934132.00004C4400028000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1018544365.00004C4400244000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://google.com/
                  Source: chrome.exe, 0000000A.00000002.1021288887.00004C4400914000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://googleusercontent.com/
                  Source: chrome.exe, 0000000A.00000003.944272305.00004C4000404000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.951011254.00004C4000622000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1016721175.00004C4000624000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goto.google.com/sme-bugs2e
                  Source: Build.exeString found in binary or memory: https://ipinfo.io/
                  Source: chrome.exe, 0000000A.00000002.1022509520.00004C4400BB0000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1026371077.00004C4401660000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1022928603.00004C4400D3C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
                  Source: chrome.exe, 0000000A.00000003.984049715.00004C44014B0000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1019634698.00004C4400594000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://lens.google.com/gen204
                  Source: chrome.exe, 0000000A.00000002.1018544365.00004C4400244000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://m.google.com/devicemanagement/data/api
                  Source: chrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1023584137.00004C4400F7C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.967170674.00004C44010E0000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1023959204.00004C44010E4000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1020115422.00004C4400730000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1023843866.00004C440107C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/chat/
                  Source: chrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/chat/:
                  Source: chrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/chat/J
                  Source: chrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1019961041.00004C44006A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/chat/download?usp=chrome_default
                  Source: chrome.exe, 0000000A.00000002.1019961041.00004C44006A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/chat/download?usp=chrome_defaultl
                  Source: chrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/mail/:
                  Source: chrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
                  Source: chrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/mail/J
                  Source: chrome.exe, 0000000A.00000003.966831567.00004C4400778000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
                  Source: chrome.exe, 0000000A.00000002.1022280291.00004C4400ABC000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1022891567.00004C4400D1C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1026199300.00004C44014F8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
                  Source: chrome.exe, 0000000A.00000002.1022719613.00004C4400C7C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1021655808.00004C44009CC000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1024076679.00004C4401124000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
                  Source: chrome.exe, 0000000A.00000002.1022719613.00004C4400C7C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1021655808.00004C44009CC000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1024076679.00004C4401124000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
                  Source: chrome.exe, 0000000A.00000003.944272305.00004C4000404000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.951011254.00004C4000622000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1016721175.00004C4000624000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://myaccount.google.com/shielded-email?utm_source=chrome2B
                  Source: chrome.exe, 0000000A.00000002.1022719613.00004C4400C7C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1021655808.00004C44009CC000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1024076679.00004C4401124000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
                  Source: chrome.exe, 0000000A.00000002.1019511269.00004C440051C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1022622659.00004C4400C1C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.989206046.000002D4C3C70000.00000002.00000001.00040000.0000000D.sdmpString found in binary or memory: https://myactivity.google.com/
                  Source: chrome.exe, 0000000A.00000002.1018544365.00004C4400244000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://oauthaccountmanager.googleapis.com/
                  Source: chrome.exe, 0000000A.00000002.1018544365.00004C4400244000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
                  Source: chrome.exe, 0000000A.00000002.1026611595.00004C4401718000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://ogs.google.com
                  Source: chrome.exe, 0000000A.00000002.1018544365.00004C4400244000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
                  Source: chrome.exe, 0000000A.00000003.984049715.00004C44014B0000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1019634698.00004C4400594000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.983903958.00004C4401490000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://outlook.office.com/calendar/
                  Source: chrome.exe, 0000000A.00000002.989206046.000002D4C3C70000.00000002.00000001.00040000.0000000D.sdmpString found in binary or memory: https://passwords.google.comSaved
                  Source: chrome.exe, 0000000A.00000002.1021834994.00004C44009EC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://passwords.google/
                  Source: chrome.exe, 0000000A.00000002.1018544365.00004C4400244000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://people.googleapis.com/
                  Source: chrome.exe, 0000000A.00000002.1019511269.00004C440051C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1022622659.00004C4400C1C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.989206046.000002D4C3C70000.00000002.00000001.00040000.0000000D.sdmpString found in binary or memory: https://policies.google.com/
                  Source: chrome.exe, 0000000A.00000002.1020513762.00004C44007D4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
                  Source: chrome.exe, 0000000A.00000002.1020513762.00004C44007D4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
                  Source: chrome.exe, 0000000A.00000002.1019152802.00004C4400464000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
                  Source: chrome.exe, 0000000A.00000002.1017192855.00004C44000C1000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1017149597.00004C4400094000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyA2KlwBX3mkFo30om9LU
                  Source: chrome.exe, 0000000A.00000002.1023091803.00004C4400DD4000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1018544365.00004C4400244000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
                  Source: chrome.exe, 0000000A.00000003.944272305.00004C4000404000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.951011254.00004C4000622000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1016721175.00004C4000624000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://shieldedids-pa.googleapis.comb
                  Source: chrome.exe, 0000000A.00000002.1022509520.00004C4400BB0000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1026371077.00004C4401660000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1022928603.00004C4400D3C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
                  Source: chrome.exe, 0000000A.00000002.1018659498.00004C4400302000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://ssl.google.cmanager.com
                  Source: chrome.exe, 0000000A.00000002.1023258674.00004C4400E24000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://ssl.gstatic.com
                  Source: chrome.exe, 0000000A.00000002.989206046.000002D4C3C70000.00000002.00000001.00040000.0000000D.sdmpString found in binary or memory: https://support.google.com/chrome/a/?p=browser_profile_details
                  Source: chrome.exe, 0000000A.00000002.989206046.000002D4C3C70000.00000002.00000001.00040000.0000000D.sdmpString found in binary or memory: https://support.google.com/chrome/answer/6098869
                  Source: chrome.exe, 0000000A.00000002.989206046.000002D4C3C70000.00000002.00000001.00040000.0000000D.sdmpString found in binary or memory: https://support.google.com/chrome/answer/96817
                  Source: chrome.exe, 0000000A.00000002.1019841412.00004C4400604000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://support.google.com/chrome?p=desktop_tab_groups
                  Source: chrome.exe, 0000000A.00000002.989206046.000002D4C3C70000.00000002.00000001.00040000.0000000D.sdmpString found in binary or memory: https://support.google.com/chromebook?p=app_intent
                  Source: tmp9474.tmp.dat.0.drString found in binary or memory: https://support.mozilla.org
                  Source: tmp9474.tmp.dat.0.drString found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
                  Source: tmp9474.tmp.dat.0.drString found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
                  Source: Build.exe, 00000000.00000002.1016471941.0000000007DFC000.00000004.00000800.00020000.00000000.sdmp, Build.exe, 00000000.00000002.1016471941.0000000007DF2000.00000004.00000800.00020000.00000000.sdmp, Build.exe, 00000000.00000002.1008445716.0000000002B6B000.00000004.00000800.00020000.00000000.sdmp, Build.exe, 00000000.00000002.1016471941.0000000007DD1000.00000004.00000800.00020000.00000000.sdmp, Extra.zip.0.drString found in binary or memory: https://t.me/ZeroTraceDeveloper
                  Source: Build.exe, 00000000.00000002.1016471941.0000000007DFC000.00000004.00000800.00020000.00000000.sdmp, Build.exe, 00000000.00000002.1016471941.0000000007DF2000.00000004.00000800.00020000.00000000.sdmp, Build.exe, 00000000.00000002.1008445716.0000000002B6B000.00000004.00000800.00020000.00000000.sdmp, Build.exe, 00000000.00000002.1016471941.0000000007DD1000.00000004.00000800.00020000.00000000.sdmp, Extra.zip.0.drString found in binary or memory: https://t.me/zerotracedev
                  Source: Build.exe, 00000000.00000002.1016471941.0000000007DFC000.00000004.00000800.00020000.00000000.sdmp, Build.exe, 00000000.00000002.1016471941.0000000007DF2000.00000004.00000800.00020000.00000000.sdmp, Build.exe, 00000000.00000002.1008445716.0000000002B6B000.00000004.00000800.00020000.00000000.sdmp, Build.exe, 00000000.00000002.1016471941.0000000007DD1000.00000004.00000800.00020000.00000000.sdmp, Extra.zip.0.drString found in binary or memory: https://t.me/zerotracegroup
                  Source: chrome.exe, 0000000A.00000002.1023091803.00004C4400DD4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://t0.gstatic.com/faviconV2
                  Source: chrome.exe, 0000000A.00000002.1018544365.00004C4400244000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tasks.googleapis.com/
                  Source: Build.exe, 00000000.00000002.1008759243.0000000003C8D000.00000004.00000800.00020000.00000000.sdmp, Build.exe, 00000000.00000002.1008759243.0000000003CAF000.00000004.00000800.00020000.00000000.sdmp, Build.exe, 00000000.00000002.1008759243.0000000003CD1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1023030617.00004C4400DA4000.00000004.00001000.00020000.00000000.sdmp, tmpFBCD.tmp.dat.0.drString found in binary or memory: https://www.ecosia.org/newtab/v20
                  Source: chrome.exe, 0000000A.00000002.1018659498.00004C44002E8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google-analytics.com
                  Source: chrome.exe, 0000000A.00000002.1023258674.00004C4400E24000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google-analytics.com;report-uri
                  Source: chrome.exe, 0000000A.00000002.1023258674.00004C4400E24000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com
                  Source: chrome.exe, 0000000A.00000003.967261174.00004C4401384000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/
                  Source: chrome.exe, 0000000A.00000002.1026371077.00004C4401660000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2
                  Source: chrome.exe, 0000000A.00000002.1026542085.00004C44016D4000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1026403350.00004C4401680000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
                  Source: chrome.exe, 0000000A.00000002.1026642903.00004C4401730000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/async/newtab_promos
                  Source: chrome.exe, 0000000A.00000002.1021834994.00004C44009EC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/chrome/#safe
                  Source: chrome.exe, 0000000A.00000002.1021655808.00004C44009CC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/chrome/browser-features/
                  Source: chrome.exe, 0000000A.00000002.1021655808.00004C44009CC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/chrome/browser-tools/
                  Source: chrome.exe, 0000000A.00000003.944272305.00004C4000404000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.951011254.00004C4000622000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1016721175.00004C4000624000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/chrome/go-mobile/?ios-campaign=desktop-chr-ntp&android-campaign=desktop-chr-n
                  Source: chrome.exe, 0000000A.00000002.989206046.000002D4C3C70000.00000002.00000001.00040000.0000000D.sdmpString found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlH&elpManaged
                  Source: chrome.exe, 0000000A.00000002.1022476677.00004C4400B8C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1026080342.00004C4401450000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1022762226.00004C4400CA8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/chrome/tips/
                  Source: Build.exe, 00000000.00000002.1008759243.0000000003C8D000.00000004.00000800.00020000.00000000.sdmp, Build.exe, 00000000.00000002.1008759243.0000000003CAF000.00000004.00000800.00020000.00000000.sdmp, Build.exe, 00000000.00000002.1008759243.0000000003CD1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1019841412.00004C4400604000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1020709013.00004C4400804000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1019866231.00004C4400674000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1023511193.00004C4400F20000.00000004.00001000.00020000.00000000.sdmp, tmpFBCD.tmp.dat.0.drString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
                  Source: chrome.exe, 0000000A.00000003.944272305.00004C4000404000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.951011254.00004C4000622000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1016721175.00004C4000624000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/search
                  Source: chrome.exe, 0000000A.00000002.1019108684.00004C4400450000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
                  Source: chrome.exe, 0000000A.00000002.1023258674.00004C4400E24000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.comAccess-Control-Allow-Credentials:
                  Source: chrome.exe, 0000000A.00000002.1018210431.00004C440021C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/
                  Source: chrome.exe, 0000000A.00000003.944272305.00004C4000404000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.951011254.00004C4000622000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1016721175.00004C4000624000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
                  Source: chrome.exe, 0000000A.00000002.1018210431.00004C440021C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
                  Source: chrome.exe, 0000000A.00000002.1018210431.00004C440021C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
                  Source: chrome.exe, 0000000A.00000002.1018210431.00004C440021C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/oauth2/v4/token
                  Source: chrome.exe, 0000000A.00000002.1018210431.00004C440021C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
                  Source: chrome.exe, 0000000A.00000002.1023258674.00004C4400E24000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.googletagmanager.com
                  Source: chrome.exe, 0000000A.00000002.1023258674.00004C4400E24000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.gstatic.com
                  Source: chrome.exe, 0000000A.00000002.1020709013.00004C4400804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
                  Source: tmp9474.tmp.dat.0.drString found in binary or memory: https://www.mozilla.org
                  Source: tmp9474.tmp.dat.0.drString found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
                  Source: tmp9474.tmp.dat.0.drString found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
                  Source: Build.exe, 00000000.00000002.1016471941.00000000082D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
                  Source: tmp9474.tmp.dat.0.drString found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
                  Source: tmp9474.tmp.dat.0.drString found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
                  Source: tmp9474.tmp.dat.0.drString found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
                  Source: chrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/:
                  Source: chrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/?feature=ytca
                  Source: chrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/J
                  Source: chrome.exe, 0000000A.00000003.966831567.00004C4400778000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49697
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49695 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49696
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49695
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49682
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49693
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49696 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49697 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49681
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49693 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49690
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49690 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49682 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49681 -> 443
                  Source: unknownHTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.7:49681 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.26.0.100:443 -> 192.168.2.7:49682 version: TLS 1.2

                  Key, Mouse, Clipboard, Microphone and Screen Capturing

                  barindex
                  Source: Build.exe, Program.cs.Net Code: CaptureDesktopScreenshot

                  System Summary

                  barindex
                  Source: Build.exe, type: SAMPLEMatched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
                  Source: Build.exe, type: SAMPLEMatched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
                  Source: Build.exe, type: SAMPLEMatched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
                  Source: Build.exe, type: SAMPLEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                  Source: Build.exe, type: SAMPLEMatched rule: Detects StormKitty infostealer Author: ditekSHen
                  Source: 0.0.Build.exe.7d0000.0.unpack, type: UNPACKEDPEMatched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
                  Source: 0.0.Build.exe.7d0000.0.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
                  Source: 0.0.Build.exe.7d0000.0.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
                  Source: 0.0.Build.exe.7d0000.0.unpack, type: UNPACKEDPEMatched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
                  Source: 0.0.Build.exe.7d0000.0.unpack, type: UNPACKEDPEMatched rule: Detects StormKitty infostealer Author: ditekSHen
                  Source: 00000000.00000000.841274944.00000000007D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
                  Source: 00000000.00000002.1008445716.0000000002B6B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
                  Source: Process Memory Space: Build.exe PID: 6924, type: MEMORYSTRMatched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
                  Source: C:\Users\user\Desktop\Build.exeCode function: 0_2_04B09D90 NtQuerySystemInformation,0_2_04B09D90
                  Source: C:\Users\user\Desktop\Build.exeCode function: 0_2_04B09D7E NtQuerySystemInformation,0_2_04B09D7E
                  Source: C:\Users\user\Desktop\Build.exeCode function: 0_2_02A9A4080_2_02A9A408
                  Source: C:\Users\user\Desktop\Build.exeCode function: 0_2_02A948E80_2_02A948E8
                  Source: C:\Users\user\Desktop\Build.exeCode function: 0_2_02A956380_2_02A95638
                  Source: C:\Users\user\Desktop\Build.exeCode function: 0_2_02A9DF000_2_02A9DF00
                  Source: C:\Users\user\Desktop\Build.exeCode function: 0_2_04B01AB00_2_04B01AB0
                  Source: C:\Users\user\Desktop\Build.exeCode function: 0_2_069996080_2_06999608
                  Source: C:\Users\user\Desktop\Build.exeCode function: 0_2_069995F70_2_069995F7
                  Source: Build.exe, 00000000.00000002.1006596679.0000000000C8E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs Build.exe
                  Source: Build.exe, 00000000.00000000.841330892.0000000000808000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameZeroTrace.exe4 vs Build.exe
                  Source: Build.exeBinary or memory string: OriginalFilenameZeroTrace.exe4 vs Build.exe
                  Source: Build.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                  Source: Build.exe, type: SAMPLEMatched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
                  Source: Build.exe, type: SAMPLEMatched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
                  Source: Build.exe, type: SAMPLEMatched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
                  Source: Build.exe, type: SAMPLEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                  Source: Build.exe, type: SAMPLEMatched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
                  Source: 0.0.Build.exe.7d0000.0.unpack, type: UNPACKEDPEMatched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
                  Source: 0.0.Build.exe.7d0000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
                  Source: 0.0.Build.exe.7d0000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
                  Source: 0.0.Build.exe.7d0000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
                  Source: 0.0.Build.exe.7d0000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
                  Source: 00000000.00000000.841274944.00000000007D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
                  Source: 00000000.00000002.1008445716.0000000002B6B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
                  Source: Process Memory Space: Build.exe PID: 6924, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
                  Source: Build.exe, Information.csBase64 encoded string: 'WmVyb1RyYWNlIERldmVsb3BlZCBCeSAgWmVyb1RyYWNlICYgQUFSCgpKb2luIENoYW5uZWwgOiBodHRwczovL3QubWUvemVyb3RyYWNlZGV2CkpvaW4gR3JvdXAgOiBodHRwczovL3QubWUvemVyb3RyYWNlZ3JvdXAKCgpXcml0ZSBUbyBEZXZlbG9wZXIgOiBodHRwczovL3QubWUvWmVyb1RyYWNlRGV2ZWxvcGVyCgpbIFRIQU5LUyBGT1IgVVNJTkcgWkVST1RSQUNFICEgXQoKPDMzMzM='
                  Source: Build.exeBinary string: ParentProcessId3\Device\LanmanRedirector\
                  Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@32/23@5/5
                  Source: C:\Users\user\Desktop\Build.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Build.exe.logJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeMutant created: NULL
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5192:120:WilError_03
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5232:120:WilError_03
                  Source: C:\Users\user\Desktop\Build.exeFile created: C:\Users\user\AppData\Local\Temp\8.46.123.189Jump to behavior
                  Source: Build.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                  Source: Build.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                  Source: C:\Users\user\Desktop\Build.exeSystem information queried: HandleInformationJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT ExecutablePath, ProcessID FROM Win32_Process
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                  Source: C:\Users\user\Desktop\Build.exeFile read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\installs.iniJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                  Source: chrome.exe, 0000000A.00000002.1021241046.00004C440090B000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
                  Source: Build.exe, 00000000.00000002.1016471941.0000000008010000.00000004.00000800.00020000.00000000.sdmp, Build.exe, 00000000.00000002.1016471941.00000000081C8000.00000004.00000800.00020000.00000000.sdmp, tmpC866.tmp.dat.0.dr, tmp2EA8.tmp.dat.0.drBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
                  Source: Build.exeVirustotal: Detection: 73%
                  Source: Build.exeReversingLabs: Detection: 80%
                  Source: unknownProcess created: C:\Users\user\Desktop\Build.exe "C:\Users\user\Desktop\Build.exe"
                  Source: C:\Users\user\Desktop\Build.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\chcp.com chcp 65001
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr All
                  Source: C:\Users\user\Desktop\Build.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\chcp.com chcp 65001
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh wlan show networks mode=bssid
                  Source: C:\Users\user\Desktop\Build.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
                  Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1964,i,11247005369938527612,18363969163184259848,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2136 /prefetch:3
                  Source: C:\Users\user\Desktop\Build.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr AllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssidJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"Jump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\chcp.com chcp 65001Jump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profileJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr AllJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\chcp.com chcp 65001Jump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh wlan show networks mode=bssidJump to behavior
                  Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1964,i,11247005369938527612,18363969163184259848,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2136 /prefetch:3Jump to behavior
                  Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: version.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: rasapi32.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: rasman.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: rtutils.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: mswsock.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: dhcpcsvc6.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: dhcpcsvc.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: dnsapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: winnsi.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: rasadhlp.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: fwpuclnt.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: secur32.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: schannel.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: mskeyprotect.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: ntasn1.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: ncrypt.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: ncryptsslp.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: vaultcli.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: wintypes.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: napinsp.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: pnrpnsp.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: wshbth.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: nlaapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: winrnr.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: wbemcomn.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: ntmarta.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: windowscodecs.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: dpapi.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeSection loaded: rstrtmgr.dllJump to behavior
                  Source: C:\Windows\SysWOW64\chcp.comSection loaded: ulib.dllJump to behavior
                  Source: C:\Windows\SysWOW64\chcp.comSection loaded: fsutilext.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ifmon.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mprapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasmontr.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasapi32.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwpuclnt.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasman.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mfc42u.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: authfwcfg.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwpolicyiomgr.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: firewallapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dnsapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwbase.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dhcpcmonitor.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dot3cfg.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dot3api.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: onex.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: eappcfg.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ncrypt.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: eappprxy.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ntasn1.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwcfg.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: hnetmon.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: netshell.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nlaapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: netsetupapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: netiohlp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dhcpcsvc.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: winnsi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nshhttp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: httpapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nshipsec.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: activeds.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: polstore.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: winipsec.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: adsldpc.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nshwfp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: cabinet.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: p2pnetsh.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: p2p.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rpcnsh.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: whhelper.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wlancfg.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wlanapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wshelper.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wevtapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mswsock.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: peerdistsh.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wcmapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rmclient.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mobilenetworking.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: slc.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: sppc.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ktmw32.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mprmsg.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Windows\SysWOW64\chcp.comSection loaded: ulib.dllJump to behavior
                  Source: C:\Windows\SysWOW64\chcp.comSection loaded: fsutilext.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ifmon.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mprapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasmontr.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasapi32.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwpuclnt.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasman.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mfc42u.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rasman.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: authfwcfg.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwpolicyiomgr.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: firewallapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dnsapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwbase.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dhcpcmonitor.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dot3cfg.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dot3api.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: onex.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: eappcfg.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ncrypt.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: eappprxy.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ntasn1.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: fwcfg.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: hnetmon.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: netshell.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nlaapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: netsetupapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: netiohlp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: dhcpcsvc.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: winnsi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nshhttp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: httpapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nshipsec.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: activeds.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: polstore.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: winipsec.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: adsldpc.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: nshwfp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: cabinet.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: p2pnetsh.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: p2p.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rpcnsh.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: whhelper.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wlancfg.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wlanapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wshelper.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wevtapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mswsock.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: peerdistsh.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wcmapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: rmclient.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mobilenetworking.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: slc.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: sppc.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: ktmw32.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: mprmsg.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
                  Source: Build.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                  Source: Build.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                  Source: Build.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                  Source: Build.exeStatic PE information: 0xFC8F558F [Thu Apr 10 06:26:23 2104 UTC]
                  Source: C:\Users\user\Desktop\Build.exeCode function: 0_2_04B00812 push es; ret 0_2_04B00820
                  Source: C:\Users\user\Desktop\Build.exeCode function: 0_2_04B0C1C0 push es; ret 0_2_04B0C1D0
                  Source: C:\Users\user\Desktop\Build.exeCode function: 0_2_0699F3F0 push es; ret 0_2_0699F400
                  Source: C:\Users\user\Desktop\Build.exeCode function: 0_2_0699C140 push eax; mov dword ptr [esp], ecx0_2_0699C204
                  Source: C:\Users\user\Desktop\Build.exeCode function: 0_2_0699A8D0 push eax; mov dword ptr [esp], ecx0_2_0699A8E4
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                  Malware Analysis System Evasion

                  barindex
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
                  Source: C:\Users\user\Desktop\Build.exeMemory allocated: 2A50000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeMemory allocated: 2AF0000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeMemory allocated: 4AF0000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeMemory allocated: 7DD0000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeMemory allocated: 8DD0000 memory reserve | memory write watchJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeWindow / User API: threadDelayed 3569Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeWindow / User API: threadDelayed 5987Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exe TID: 7088Thread sleep time: -34126476536362649s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                  Source: C:\Users\user\Desktop\Build.exeThread delayed: delay time: 922337203685477Jump to behavior
                  Source: Build.exeBinary or memory string: VMware
                  Source: tmpFC0E.tmp.dat.0.drBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
                  Source: tmpFC0E.tmp.dat.0.drBinary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
                  Source: tmpFC0E.tmp.dat.0.drBinary or memory string: Canara Transaction PasswordVMware20,11696492231}
                  Source: tmpFC0E.tmp.dat.0.drBinary or memory string: interactivebrokers.co.inVMware20,11696492231d
                  Source: tmpFC0E.tmp.dat.0.drBinary or memory string: netportal.hdfcbank.comVMware20,11696492231
                  Source: tmpFC0E.tmp.dat.0.drBinary or memory string: outlook.office.comVMware20,11696492231s
                  Source: tmpFC0E.tmp.dat.0.drBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
                  Source: tmpFC0E.tmp.dat.0.drBinary or memory string: AMC password management pageVMware20,11696492231
                  Source: tmpFC0E.tmp.dat.0.drBinary or memory string: interactivebrokers.comVMware20,11696492231
                  Source: tmpFC0E.tmp.dat.0.drBinary or memory string: microsoft.visualstudio.comVMware20,11696492231x
                  Source: chrome.exe, 0000000A.00000003.952907714.00004C4400320000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: VMware20,1(
                  Source: tmpFC0E.tmp.dat.0.drBinary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
                  Source: tmpFC0E.tmp.dat.0.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
                  Source: tmpFC0E.tmp.dat.0.drBinary or memory string: Test URL for global passwords blocklistVMware20,11696492231
                  Source: Build.exeBinary or memory string: Hyper-V Video
                  Source: tmpFC0E.tmp.dat.0.drBinary or memory string: outlook.office365.comVMware20,11696492231t
                  Source: tmpFC0E.tmp.dat.0.drBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
                  Source: tmpFC0E.tmp.dat.0.drBinary or memory string: discord.comVMware20,11696492231f
                  Source: Build.exe, 00000000.00000002.1006596679.0000000000CC3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                  Source: tmpFC0E.tmp.dat.0.drBinary or memory string: global block list test formVMware20,11696492231
                  Source: tmpFC0E.tmp.dat.0.drBinary or memory string: dev.azure.comVMware20,11696492231j
                  Source: tmpFC0E.tmp.dat.0.drBinary or memory string: www.interactivebrokers.comVMware20,11696492231}
                  Source: tmpFC0E.tmp.dat.0.drBinary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
                  Source: tmpFC0E.tmp.dat.0.drBinary or memory string: bankofamerica.comVMware20,11696492231x
                  Source: tmpFC0E.tmp.dat.0.drBinary or memory string: trackpan.utiitsl.comVMware20,11696492231h
                  Source: tmpFC0E.tmp.dat.0.drBinary or memory string: tasks.office.comVMware20,11696492231o
                  Source: tmpFC0E.tmp.dat.0.drBinary or memory string: account.microsoft.com/profileVMware20,11696492231u
                  Source: tmpFC0E.tmp.dat.0.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696492231
                  Source: chrome.exe, 0000000A.00000002.1027580099.00007FFBECEA1000.00000020.00000001.01000000.00000009.sdmpBinary or memory string: xVMcI
                  Source: tmpFC0E.tmp.dat.0.drBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
                  Source: tmpFC0E.tmp.dat.0.drBinary or memory string: ms.portal.azure.comVMware20,11696492231
                  Source: Build.exeBinary or memory string: VMware Virtual
                  Source: tmpFC0E.tmp.dat.0.drBinary or memory string: turbotax.intuit.comVMware20,11696492231t
                  Source: tmpFC0E.tmp.dat.0.drBinary or memory string: secure.bankofamerica.comVMware20,11696492231|UE
                  Source: tmpFC0E.tmp.dat.0.drBinary or memory string: Canara Transaction PasswordVMware20,11696492231x
                  Source: chrome.exe, 0000000A.00000002.988779327.000002D4C3A58000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllhh
                  Source: tmpFC0E.tmp.dat.0.drBinary or memory string: Interactive Brokers - HKVMware20,11696492231]
                  Source: C:\Users\user\Desktop\Build.exeProcess information queried: ProcessInformationJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess token adjusted: DebugJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeMemory allocated: page read and write | page guardJump to behavior

                  HIPS / PFW / Operating System Protection Evasion

                  barindex
                  Source: Build.exe, ImportHider.csReference to suspicious API methods: LoadLibrary(dllName)
                  Source: Build.exe, ImportHider.csReference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(intPtr, methodName), typeof(T))
                  Source: Build.exe, LockHelper.csReference to suspicious API methods: Interop.Kernel32.OpenProcess(Interop.ProcessAccessFlags.DuplicateHandle, bInheritHandle: true, (uint)targetPid)
                  Source: C:\Users\user\Desktop\Build.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr AllJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssidJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"Jump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\chcp.com chcp 65001Jump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profileJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\findstr.exe findstr AllJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\chcp.com chcp 65001Jump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh wlan show networks mode=bssidJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeQueries volume information: C:\Users\user\Desktop\Build.exe VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\netsh.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                  Lowering of HIPS / PFW / Operating System Security Settings

                  barindex
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile
                  Source: Build.exe, 00000000.00000002.1015983211.00000000071AA000.00000004.00000020.00020000.00000000.sdmp, Build.exe, 00000000.00000002.1006596679.0000000000CC3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
                  Source: C:\Users\user\Desktop\Build.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct

                  Stealing of Sensitive Information

                  barindex
                  Source: Yara matchFile source: 00000000.00000002.1016471941.0000000007DFC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: Build.exe PID: 6924, type: MEMORYSTR
                  Source: Yara matchFile source: Build.exe, type: SAMPLE
                  Source: Yara matchFile source: 0.0.Build.exe.7d0000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000000.00000000.841274944.00000000007D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.1008445716.0000000002B6B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: Build.exe PID: 6924, type: MEMORYSTR
                  Source: Build.exe, 00000000.00000000.841274944.00000000007D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: \wallets\%\Electrum\wallets\
                  Source: Build.exe, 00000000.00000000.841274944.00000000007D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: \wallets\%\Electrum\wallets\
                  Source: Build.exe, 00000000.00000000.841274944.00000000007D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: bytecoinJaxx!com.liberty.jaxx
                  Source: Build.exe, 00000000.00000000.841274944.00000000007D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: \Exodus\
                  Source: Build.exe, 00000000.00000002.1008445716.0000000002AF1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: q4C:\Users\user\AppData\Roaming\Ethereum\keystore
                  Source: Build.exe, 00000000.00000000.841274944.00000000007D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: ExodusAaholpfdialjgjfhomihkjbmgjidlcdno
                  Source: Build.exe, 00000000.00000000.841274944.00000000007D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: Ethereum
                  Source: Build.exe, 00000000.00000002.1008445716.0000000002AF1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: q:C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets
                  Source: Build.exe, 00000000.00000000.841274944.00000000007D2000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: keystore
                  Source: C:\Users\user\Desktop\Build.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profile
                  Source: C:\Users\user\Desktop\Build.exeProcess created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr AllJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\netsh.exe netsh wlan show profileJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\c64980e6-c743-4793-ba4a-89f593d4eb16Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqliteJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-walJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shmJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-walJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\2c8e5eea-375d-48a9-ad4c-be583ff1215dJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491695562.2c8e5eea-375d-48a9-ad4c-be583ff1215d.health.jsonlz4Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\targeting.snapshot.jsonJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-walJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\372e391e-787d-40e8-8beb-44106d6c22f4Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shmJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shmJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\ExperimentStoreData.jsonJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\AlternateServices.txtJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\y572q81e.default\times.jsonJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.jsJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\6786f292-c1be-4996-99cd-77aa855c1844Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqliteJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqliteJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\pkcs11.txtJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\59bd13a9-8183-4ac7-8723-9621ae6d3748Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\shield-preference-experiments.jsonJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491695610.18a05d94-e006-440f-b702-3e398a280dbf.health.jsonlz4Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\f5c2d345-4cad-4c1a-a51d-15d682036066Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\2824c836-2afd-4a95-940b-ed2b991ba55dJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqliteJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\7b2ddd96-6d27-491a-a7e0-811ed320f1f0Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\HistoryJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491690337.3be89113-af2b-4b48-9c47-40ac1156f7a2.new-profile.jsonlz4Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\01e461df-d85d-4561-a852-205de2d67f32Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\SiteSecurityServiceState.txtJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\18a05d94-e006-440f-b702-3e398a280dbfJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491695614.edd11145-a3b3-4ebf-ba7b-14b7ec08f19f.main.jsonlz4Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491690340.2824c836-2afd-4a95-940b-ed2b991ba55d.event.jsonlz4Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\.metadata-v2Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqliteJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\7917ce80-55b3-46ca-99c2-70537bbb959aJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\58b46d46-b146-420f-81af-5b32c19a8aefJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HistoryJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\events\eventsJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\parent.lockJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\protections.sqliteJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\7a27ea16-e265-40c0-823c-0125abf7d855Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\permissions.sqliteJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491690344.6260e81e-5ef5-4137-a0a5-7930ea6f0a75.main.jsonlz4Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\compatibility.iniJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shmJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\extension-preferences.jsonJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\054622d9-6ed7-4f25-87fd-b3a9cd668b65Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\12672553-cb8c-4210-ae02-a59c1a541208Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\5e0297e1-aa9b-4634-aaf1-cfd1f718b993Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\b3c274f7-6fd8-4832-989b-74a48f86b6b5Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\6db12043-3902-4d45-8c5d-d992fbf6d4e7Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shmJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqliteJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-walJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\webappsstore.sqlite-shmJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\xulstore.jsonJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\session-state.jsonJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.dbJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-walJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\times.jsonJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\e6e57dc0-d354-4d4a-8374-548b8e2bcc5dJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\handlers.jsonJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\db\data.safe.binJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491690347.6786f292-c1be-4996-99cd-77aa855c1844.first-shutdown.jsonlz4Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\ff032c8b-05e6-43c9-9e84-732dbe7aca27Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\1696491695606.ff032c8b-05e6-43c9-9e84-732dbe7aca27.event.jsonlz4Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-walJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqliteJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\758d1c71-5fff-4193-9977-7a57afa68bf7Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\search.json.mozlz4Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\3b7fc3d4-90d3-48a3-834f-e61d315e9a5cJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shmJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-walJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\favicons.sqlite-shmJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\favicons.sqliteJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\6c257ec7-9ee7-4e42-91a6-7d3b50c23b76Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\010cab1b-3626-48b5-9d6b-0e4dfe4db5faJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-walJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\content-prefs.sqliteJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore-backups\previous.jsonlz4Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\webappsstore.sqliteJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\webappsstore.sqlite-walJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\containers.jsonJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqliteJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionCheckpoints.jsonJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\ls-archive.sqliteJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\7f0194d6-62d6-4174-a7ed-55ebc13aacb4Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\addons.jsonJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\2b167346-5f76-4c00-8f97-19cee0df0fbaJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.dbJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore.jsonlz4Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\6260e81e-5ef5-4137-a0a5-7930ea6f0a75Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\favicons.sqlite-walJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage.sqliteJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\events\background-updateJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\edd11145-a3b3-4ebf-ba7b-14b7ec08f19fJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\addonStartup.json.lz4Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\state.jsonJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\3be89113-af2b-4b48-9c47-40ac1156f7a2Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shmJump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\wallets\Jump to behavior
                  Source: C:\Users\user\Desktop\Build.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\wallets\Jump to behavior
                  Source: Yara matchFile source: Build.exe, type: SAMPLE
                  Source: Yara matchFile source: 0.0.Build.exe.7d0000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000000.00000000.841274944.00000000007D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.1008445716.0000000002B6B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: Build.exe PID: 6924, type: MEMORYSTR

                  Remote Access Functionality

                  barindex
                  Source: C:\Users\user\Desktop\Build.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
                  Source: Yara matchFile source: 00000000.00000002.1016471941.0000000007DFC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: Build.exe PID: 6924, type: MEMORYSTR
                  Source: Yara matchFile source: Build.exe, type: SAMPLE
                  Source: Yara matchFile source: 0.0.Build.exe.7d0000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000000.00000000.841274944.00000000007D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.1008445716.0000000002B6B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: Build.exe PID: 6924, type: MEMORYSTR
                  ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                  Gather Victim Identity InformationAcquire InfrastructureValid Accounts231
                  Windows Management Instrumentation
                  1
                  DLL Side-Loading
                  11
                  Process Injection
                  1
                  Masquerading
                  1
                  OS Credential Dumping
                  241
                  Security Software Discovery
                  Remote Services1
                  Screen Capture
                  21
                  Encrypted Channel
                  Exfiltration Over Other Network MediumAbuse Accessibility Features
                  CredentialsDomainsDefault Accounts1
                  Native API
                  Boot or Logon Initialization Scripts1
                  DLL Side-Loading
                  11
                  Disable or Modify Tools
                  LSASS Memory2
                  Process Discovery
                  Remote Desktop Protocol1
                  Archive Collected Data
                  1
                  Non-Standard Port
                  Exfiltration Over BluetoothNetwork Denial of Service
                  Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
                  Extra Window Memory Injection
                  251
                  Virtualization/Sandbox Evasion
                  Security Account Manager251
                  Virtualization/Sandbox Evasion
                  SMB/Windows Admin Shares3
                  Data from Local System
                  1
                  Remote Access Software
                  Automated ExfiltrationData Encrypted for Impact
                  Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook11
                  Process Injection
                  NTDS1
                  Application Window Discovery
                  Distributed Component Object ModelInput Capture1
                  Ingress Tool Transfer
                  Traffic DuplicationData Destruction
                  Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script11
                  Obfuscated Files or Information
                  LSA Secrets1
                  File and Directory Discovery
                  SSHKeylogging2
                  Non-Application Layer Protocol
                  Scheduled TransferData Encrypted for Impact
                  Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
                  Timestomp
                  Cached Domain Credentials135
                  System Information Discovery
                  VNCGUI Input Capture3
                  Application Layer Protocol
                  Data Transfer Size LimitsService Stop
                  DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                  DLL Side-Loading
                  DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                  Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
                  Extra Window Memory Injection
                  Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                  Hide Legend

                  Legend:

                  • Process
                  • Signature
                  • Created File
                  • DNS/IP Info
                  • Is Dropped
                  • Is Windows Process
                  • Number of created Registry Values
                  • Number of created Files
                  • Visual Basic
                  • Delphi
                  • Java
                  • .Net C# or VB.NET
                  • C, C++ or other language
                  • Is malicious
                  • Internet
                  behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1639402 Sample: Build.exe Startdate: 15/03/2025 Architecture: WINDOWS Score: 100 39 ipinfo.io 2->39 41 get.geojs.io 2->41 43 144.48.8.0.in-addr.arpa 2->43 53 Malicious sample detected (through community Yara rule) 2->53 55 Antivirus / Scanner detection for submitted sample 2->55 57 Sigma detected: Capture Wi-Fi password 2->57 59 6 other signatures 2->59 8 Build.exe 35 39 2->8         started        signatures3 process4 dnsIp5 45 ipinfo.io 34.117.59.81, 443, 49681 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 8->45 47 get.geojs.io 104.26.0.100, 443, 49682 CLOUDFLARENETUS United States 8->47 49 2 other IPs or domains 8->49 37 C:\Users\user\AppData\Local\...\Build.exe.log, ASCII 8->37 dropped 61 Attempt to bypass Chrome Application-Bound Encryption 8->61 63 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 8->63 65 Found many strings related to Crypto-Wallets (likely being stolen) 8->65 67 4 other signatures 8->67 13 cmd.exe 1 8->13         started        16 chrome.exe 8->16         started        18 cmd.exe 1 8->18         started        file6 signatures7 process8 signatures9 69 Uses netsh to modify the Windows network and firewall settings 13->69 71 Tries to harvest and steal WLAN passwords 13->71 20 netsh.exe 2 13->20         started        22 conhost.exe 13->22         started        24 findstr.exe 1 13->24         started        26 chcp.com 1 13->26         started        28 chrome.exe 16->28         started        31 netsh.exe 2 18->31         started        33 conhost.exe 18->33         started        35 chcp.com 1 18->35         started        process10 dnsIp11 51 www.google.com 172.217.16.196, 443, 49690, 49693 GOOGLEUS United States 28->51

                  This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                  windows-stand
                  SourceDetectionScannerLabelLink
                  Build.exe74%VirustotalBrowse
                  Build.exe81%ReversingLabsByteCode-MSIL.Trojan.DataStealer
                  Build.exe100%AviraTR/PSW.Agent.ampoq
                  No Antivirus matches
                  No Antivirus matches
                  No Antivirus matches
                  SourceDetectionScannerLabelLink
                  https://ssl.google.cmanager.com0%Avira URL Cloudsafe
                  https://clients2.goog0%Avira URL Cloudsafe
                  NameIPActiveMaliciousAntivirus DetectionReputation
                  ipinfo.io
                  34.117.59.81
                  truefalse
                    high
                    get.geojs.io
                    104.26.0.100
                    truefalse
                      high
                      www.google.com
                      172.217.16.196
                      truefalse
                        high
                        144.48.8.0.in-addr.arpa
                        unknown
                        unknownfalse
                          unknown
                          NameMaliciousAntivirus DetectionReputation
                          https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0false
                            high
                            https://ipinfo.io/false
                              high
                              NameSourceMaliciousAntivirus DetectionReputation
                              https://mail.google.com/mail/?usp=installed_webappchrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpfalse
                                high
                                https://goto.google.com/sme-bugs2echrome.exe, 0000000A.00000003.944272305.00004C4000404000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.951011254.00004C4000622000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1016721175.00004C4000624000.00000004.00001000.00020000.00000000.sdmpfalse
                                  high
                                  https://duckduckgo.com/ac/?q=tmpFBCD.tmp.dat.0.drfalse
                                    high
                                    https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditingchrome.exe, 0000000A.00000002.1019152802.00004C4400464000.00000004.00001000.00020000.00000000.sdmpfalse
                                      high
                                      https://support.google.com/chrome/answer/6098869chrome.exe, 0000000A.00000002.989206046.000002D4C3C70000.00000002.00000001.00040000.0000000D.sdmpfalse
                                        high
                                        https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=bchrome.exe, 0000000A.00000002.1020709013.00004C4400804000.00000004.00001000.00020000.00000000.sdmpfalse
                                          high
                                          https://docs.google.com/document/Jchrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpfalse
                                            high
                                            https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhonechrome.exe, 0000000A.00000002.1022719613.00004C4400C7C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1021655808.00004C44009CC000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1024076679.00004C4401124000.00000004.00001000.00020000.00000000.sdmpfalse
                                              high
                                              https://www.youtube.com/:chrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpfalse
                                                high
                                                https://csp.withgoogle.com/csp/clientupdate-aus/1Cache-Control:chrome.exe, 0000000A.00000002.1017663274.00004C4400168000.00000004.00001000.00020000.00000000.sdmpfalse
                                                  high
                                                  https://blog.google/products/chrome/google-chrome-safe-browsing-real-time/chrome.exe, 0000000A.00000002.1021481827.00004C4400958000.00000004.00001000.00020000.00000000.sdmpfalse
                                                    high
                                                    https://mail.google.com/mail/:chrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpfalse
                                                      high
                                                      https://support.google.com/chrome?p=desktop_tab_groupschrome.exe, 0000000A.00000002.1019841412.00004C4400604000.00000004.00001000.00020000.00000000.sdmpfalse
                                                        high
                                                        https://chrome.google.com/webstore?hl=enchrome.exe, 0000000A.00000002.1008602756.000002D4C7D37000.00000004.10000000.00040000.00000000.sdmp, chrome.exe, 0000000A.00000002.1023091803.00004C4400DD4000.00000004.00001000.00020000.00000000.sdmpfalse
                                                          high
                                                          http://dns-tunnel-check.googlezip.net/connectchrome.exe, 0000000A.00000002.1023812196.00004C4401068000.00000004.00001000.00020000.00000000.sdmpfalse
                                                            high
                                                            https://csp.withgoogle.com/csp/report-to/gws/cdt1chrome.exe, 0000000A.00000002.1027106711.00004C44017E8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                              high
                                                              https://docs.google.com/document/:chrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                high
                                                                https://mail.google.com/chat/download?usp=chrome_defaultchrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1019961041.00004C44006A0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                  high
                                                                  https://www.google.com/tools/feedback/chrome/__submitchrome.exe, 0000000A.00000002.1019108684.00004C4400450000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                    high
                                                                    https://mail.google.com/chat/chrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1023584137.00004C4400F7C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.967170674.00004C44010E0000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1023959204.00004C44010E4000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1020115422.00004C4400730000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1023843866.00004C440107C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                      high
                                                                      https://www.google.comchrome.exe, 0000000A.00000002.1023258674.00004C4400E24000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                        high
                                                                        https://mail.google.com/mail/Jchrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                          high
                                                                          https://calendar.google.comchrome.exe, 0000000A.00000003.984049715.00004C44014B0000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1019634698.00004C4400594000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1026080342.00004C4401450000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.983903958.00004C4401490000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                            high
                                                                            https://github.com/LimerBoy/StormKittyBuild.exefalse
                                                                              high
                                                                              http://unisolated.invalid/chrome.exe, 0000000A.00000002.1023060403.00004C4400DBC000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                high
                                                                                https://mail.google.com/chat/:chrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                  high
                                                                                  https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrlchrome.exe, 0000000A.00000002.989206046.000002D4C3C70000.00000002.00000001.00040000.0000000D.sdmpfalse
                                                                                    high
                                                                                    https://www.google.com/chrome/tips/chrome.exe, 0000000A.00000002.1022476677.00004C4400B8C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1026080342.00004C4401450000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1022762226.00004C4400CA8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                      high
                                                                                      https://drive.google.com/?lfhs=2chrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                        high
                                                                                        http://developer.chrome.com/docs/extensions/how-to/distribute/install-extensions)chrome.exe, 0000000A.00000002.1020393435.00004C44007BC000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1021212107.00004C44008EC000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1021315248.00004C4400928000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                          high
                                                                                          https://www.youtube.com/s/notifications/manifest/cr_install.htmlchrome.exe, 0000000A.00000003.966831567.00004C4400778000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                            high
                                                                                            https://chromestatus.com/features#browsers.chrome.status%3A%22Deprecated%22chrome.exe, 0000000A.00000002.989206046.000002D4C3C70000.00000002.00000001.00040000.0000000D.sdmpfalse
                                                                                              high
                                                                                              http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameBuild.exe, 00000000.00000002.1008445716.0000000002AF1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                high
                                                                                                https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLKtmp9474.tmp.dat.0.drfalse
                                                                                                  high
                                                                                                  https://www.youtube.com/?feature=ytcachrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                    high
                                                                                                    https://www.google.com/chrome/browser-tools/chrome.exe, 0000000A.00000002.1021655808.00004C44009CC000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                      high
                                                                                                      https://www.youtube.com/Jchrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                        high
                                                                                                        https://docs.google.com/forms/u/0/create?usp=chrome_actionschrome.exe, 0000000A.00000002.1022719613.00004C4400C7C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1022330657.00004C4400B18000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1025923848.00004C44013E0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                          high
                                                                                                          https://docs.google.com/document/u/0/create?usp=chrome_actionschrome.exe, 0000000A.00000002.1022719613.00004C4400C7C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1022330657.00004C4400B18000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1025923848.00004C44013E0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                            high
                                                                                                            https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGAchrome.exe, 0000000A.00000002.1022280291.00004C4400ABC000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1022891567.00004C4400D1C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1026199300.00004C44014F8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                              high
                                                                                                              https://support.google.com/chromebook?p=app_intentchrome.exe, 0000000A.00000002.989206046.000002D4C3C70000.00000002.00000001.00040000.0000000D.sdmpfalse
                                                                                                                high
                                                                                                                https://chromewebstore.google.com/category/themeschrome.exe, 0000000A.00000002.1021655808.00004C44009CC000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                  high
                                                                                                                  https://chrome.google.com/webstorechrome.exe, 0000000A.00000003.967261174.00004C4401384000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                    high
                                                                                                                    https://mail.google.com/chat/download?usp=chrome_defaultlchrome.exe, 0000000A.00000002.1019961041.00004C44006A0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                      high
                                                                                                                      https://chrome.google.com/webstore?hl=en&category=theme81https://myactivity.google.com/myactivity/?uchrome.exe, 0000000A.00000002.989206046.000002D4C3C70000.00000002.00000001.00040000.0000000D.sdmpfalse
                                                                                                                        high
                                                                                                                        https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=tmpFBCD.tmp.dat.0.drfalse
                                                                                                                          high
                                                                                                                          https://support.google.com/chrome/answer/96817chrome.exe, 0000000A.00000002.989206046.000002D4C3C70000.00000002.00000001.00040000.0000000D.sdmpfalse
                                                                                                                            high
                                                                                                                            https://csp.withgoogle.com/csp/gws/cdt1Cross-Origin-Opener-Policy:chrome.exe, 0000000A.00000002.1027106711.00004C44017E8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                              high
                                                                                                                              https://myaccount.google.com/shielded-email?utm_source=chrome2Bchrome.exe, 0000000A.00000003.944272305.00004C4000404000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.951011254.00004C4000622000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1016721175.00004C4000624000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                high
                                                                                                                                https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-kchrome.exe, 0000000A.00000002.1020513762.00004C44007D4000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                  high
                                                                                                                                  https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-brtmp9474.tmp.dat.0.drfalse
                                                                                                                                    high
                                                                                                                                    https://www.google.com/chrome/#safechrome.exe, 0000000A.00000002.1021834994.00004C44009EC000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                      high
                                                                                                                                      https://www.google.com/chrome/browser-features/chrome.exe, 0000000A.00000002.1021655808.00004C44009CC000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                        high
                                                                                                                                        https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actionschrome.exe, 0000000A.00000002.1022719613.00004C4400C7C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1022330657.00004C4400B18000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1025923848.00004C44013E0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                          high
                                                                                                                                          https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacychrome.exe, 0000000A.00000002.1022719613.00004C4400C7C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1021655808.00004C44009CC000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1024076679.00004C4401124000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                            high
                                                                                                                                            https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-kchrome.exe, 0000000A.00000002.1020513762.00004C44007D4000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                              high
                                                                                                                                              https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrlchrome.exe, 0000000A.00000002.989206046.000002D4C3C70000.00000002.00000001.00040000.0000000D.sdmpfalse
                                                                                                                                                high
                                                                                                                                                https://google-ohttp-relay-join.fastly-edge.com/2Jchrome.exe, 0000000A.00000003.944272305.00004C4000404000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.951011254.00004C4000622000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1016721175.00004C4000624000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                  high
                                                                                                                                                  https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=bchrome.exe, 0000000A.00000002.1020709013.00004C4400804000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                    high
                                                                                                                                                    https://m.google.com/devicemanagement/data/apichrome.exe, 0000000A.00000002.1018544365.00004C4400244000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                      high
                                                                                                                                                      https://docs.google.com/presentation/u/0/create?usp=chrome_actionschrome.exe, 0000000A.00000002.1022719613.00004C4400C7C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1022330657.00004C4400B18000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1025923848.00004C44013E0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                        high
                                                                                                                                                        https://chromewebstore.google.com/chrome.exe, 0000000A.00000002.1017754259.00004C4400194000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                          high
                                                                                                                                                          https://chromewebstore.google.com/category/extensionschrome.exe, 0000000A.00000002.1021655808.00004C44009CC000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                            high
                                                                                                                                                            https://github.com/LimerBoy/StormKitty0&Build.exe, 00000000.00000002.1008445716.0000000002B6B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                              high
                                                                                                                                                              https://ssl.google.cmanager.comchrome.exe, 0000000A.00000002.1018659498.00004C4400302000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                              • Avira URL Cloud: safe
                                                                                                                                                              unknown
                                                                                                                                                              https://csp.withgoogle.com/csp/gws/cdt1chrome.exe, 0000000A.00000002.1027106711.00004C44017E8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                high
                                                                                                                                                                https://www.google.com/chrome.exe, 0000000A.00000003.967261174.00004C4401384000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                  high
                                                                                                                                                                  https://clients4.google.com/chrome-syncchrome.exe, 0000000A.00000002.1018544365.00004C4400244000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                    high
                                                                                                                                                                    https://gemini.google.com/app?q=tmpFBCD.tmp.dat.0.drfalse
                                                                                                                                                                      high
                                                                                                                                                                      http://google.com/chrome.exe, 0000000A.00000002.1017082825.00004C440008A000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                        high
                                                                                                                                                                        https://csp.withgoogle.com/csp/clientupdate-aus/1chrome.exe, 0000000A.00000002.1007502580.000002D4C765D000.00000004.10000000.00040000.00000000.sdmpfalse
                                                                                                                                                                          high
                                                                                                                                                                          https://mail.google.com/mail/installwebapp?usp=chrome_defaultchrome.exe, 0000000A.00000003.966831567.00004C4400778000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                            high
                                                                                                                                                                            https://docs.google.com/presentation/Jchrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                              high
                                                                                                                                                                              http://www.unicode.org/copyright.htmlchrome.exe, 0000000A.00000002.989461393.000002D4C4866000.00000002.00000001.00040000.0000000E.sdmpfalse
                                                                                                                                                                                high
                                                                                                                                                                                https://drive.google.com/drive/installwebapp?usp=chrome_defaultchrome.exe, 0000000A.00000003.966831567.00004C4400778000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                  high
                                                                                                                                                                                  https://chrome.google.com/webstoreLDDiscoverchrome.exe, 0000000A.00000003.967073494.00004C440118E000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1024338114.00004C4401198000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.967073494.00004C4401188000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.967261174.00004C4401384000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                    high
                                                                                                                                                                                    https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=Build.exe, 00000000.00000002.1008759243.0000000003C8D000.00000004.00000800.00020000.00000000.sdmp, Build.exe, 00000000.00000002.1008759243.0000000003CAF000.00000004.00000800.00020000.00000000.sdmp, Build.exe, 00000000.00000002.1008759243.0000000003CD1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1023030617.00004C4400DA4000.00000004.00001000.00020000.00000000.sdmp, tmpFBCD.tmp.dat.0.drfalse
                                                                                                                                                                                      high
                                                                                                                                                                                      https://docs.google.com/document/installwebapp?usp=chrome_defaultchrome.exe, 0000000A.00000003.966831567.00004C4400778000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                        high
                                                                                                                                                                                        https://docs.google.com/presentation/:chrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                          high
                                                                                                                                                                                          https://docs.google.com/presentation/installwebapp?usp=chrome_defaultchrome.exe, 0000000A.00000003.966831567.00004C4400778000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                            high
                                                                                                                                                                                            https://passwords.google.comSavedchrome.exe, 0000000A.00000002.989206046.000002D4C3C70000.00000002.00000001.00040000.0000000D.sdmpfalse
                                                                                                                                                                                              high
                                                                                                                                                                                              https://lens.google.com/gen204chrome.exe, 0000000A.00000003.984049715.00004C44014B0000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1019634698.00004C4400594000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                high
                                                                                                                                                                                                https://docs.google.com/spreadsheets/Jchrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                  high
                                                                                                                                                                                                  https://www.google.com/images/branding/product/ico/googleg_alldp.icoBuild.exe, 00000000.00000002.1008759243.0000000003C8D000.00000004.00000800.00020000.00000000.sdmp, Build.exe, 00000000.00000002.1008759243.0000000003CAF000.00000004.00000800.00020000.00000000.sdmp, Build.exe, 00000000.00000002.1008759243.0000000003CD1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1019841412.00004C4400604000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1020709013.00004C4400804000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1019866231.00004C4400674000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1023511193.00004C4400F20000.00000004.00001000.00020000.00000000.sdmp, tmpFBCD.tmp.dat.0.drfalse
                                                                                                                                                                                                    high
                                                                                                                                                                                                    https://myactivity.google.com/chrome.exe, 0000000A.00000002.1019511269.00004C440051C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1022622659.00004C4400C1C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.989206046.000002D4C3C70000.00000002.00000001.00040000.0000000D.sdmpfalse
                                                                                                                                                                                                      high
                                                                                                                                                                                                      https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=bchrome.exe, 0000000A.00000002.1020709013.00004C4400804000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                        high
                                                                                                                                                                                                        https://docs.google.com/spreadsheets/?usp=installed_webappchrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          high
                                                                                                                                                                                                          https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEchrome.exe, 0000000A.00000002.1022509520.00004C4400BB0000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1026371077.00004C4401660000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1022928603.00004C4400D3C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                            high
                                                                                                                                                                                                            https://www.google.com/chrome/privacy/eula_text.htmlH&elpManagedchrome.exe, 0000000A.00000002.989206046.000002D4C3C70000.00000002.00000001.00040000.0000000D.sdmpfalse
                                                                                                                                                                                                              high
                                                                                                                                                                                                              https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchBuild.exe, 00000000.00000002.1008759243.0000000003C8D000.00000004.00000800.00020000.00000000.sdmp, Build.exe, 00000000.00000002.1008759243.0000000003CAF000.00000004.00000800.00020000.00000000.sdmp, Build.exe, 00000000.00000002.1008759243.0000000003CD1000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1023030617.00004C4400DA4000.00000004.00001000.00020000.00000000.sdmp, tmpFBCD.tmp.dat.0.drfalse
                                                                                                                                                                                                                high
                                                                                                                                                                                                                https://get.geojs.ioBuild.exe, 00000000.00000002.1008445716.0000000002B6B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                  high
                                                                                                                                                                                                                  https://chromeenterprise.google/policies/#BrowserSwitcherUrlListchrome.exe, 0000000A.00000002.989206046.000002D4C3C70000.00000002.00000001.00040000.0000000D.sdmpfalse
                                                                                                                                                                                                                    high
                                                                                                                                                                                                                    https://docs.google.com/spreadsheets/:chrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                      high
                                                                                                                                                                                                                      https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePWchrome.exe, 0000000A.00000002.1022719613.00004C4400C7C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1021655808.00004C44009CC000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1024076679.00004C4401124000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                        high
                                                                                                                                                                                                                        https://policies.google.com/chrome.exe, 0000000A.00000002.1019511269.00004C440051C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1022622659.00004C4400C1C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.989206046.000002D4C3C70000.00000002.00000001.00040000.0000000D.sdmpfalse
                                                                                                                                                                                                                          high
                                                                                                                                                                                                                          https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actionschrome.exe, 0000000A.00000002.1022719613.00004C4400C7C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1022330657.00004C4400B18000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000002.1025923848.00004C44013E0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                            high
                                                                                                                                                                                                                            https://clients2.googchrome.exe, 0000000A.00000002.1022133868.00004C4400A48000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                            • Avira URL Cloud: safe
                                                                                                                                                                                                                            unknown
                                                                                                                                                                                                                            https://fonts.google.com/icons?selected=Materialchrome.exe, 0000000A.00000002.1026303313.00004C4401604000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.984462771.00004C4401504000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000000A.00000003.984388827.00004C44015B8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                              high
                                                                                                                                                                                                                              • No. of IPs < 25%
                                                                                                                                                                                                                              • 25% < No. of IPs < 50%
                                                                                                                                                                                                                              • 50% < No. of IPs < 75%
                                                                                                                                                                                                                              • 75% < No. of IPs
                                                                                                                                                                                                                              IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                                              34.117.59.81
                                                                                                                                                                                                                              ipinfo.ioUnited States
                                                                                                                                                                                                                              139070GOOGLE-AS-APGoogleAsiaPacificPteLtdSGfalse
                                                                                                                                                                                                                              23.94.126.116
                                                                                                                                                                                                                              unknownUnited States
                                                                                                                                                                                                                              36352AS-COLOCROSSINGUSfalse
                                                                                                                                                                                                                              172.217.16.196
                                                                                                                                                                                                                              www.google.comUnited States
                                                                                                                                                                                                                              15169GOOGLEUSfalse
                                                                                                                                                                                                                              104.26.0.100
                                                                                                                                                                                                                              get.geojs.ioUnited States
                                                                                                                                                                                                                              13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                                              IP
                                                                                                                                                                                                                              127.0.0.1
                                                                                                                                                                                                                              Joe Sandbox version:42.0.0 Malachite
                                                                                                                                                                                                                              Analysis ID:1639402
                                                                                                                                                                                                                              Start date and time:2025-03-15 14:34:14 +01:00
                                                                                                                                                                                                                              Joe Sandbox product:CloudBasic
                                                                                                                                                                                                                              Overall analysis duration:0h 6m 23s
                                                                                                                                                                                                                              Hypervisor based Inspection enabled:false
                                                                                                                                                                                                                              Report type:full
                                                                                                                                                                                                                              Cookbook file name:default.jbs
                                                                                                                                                                                                                              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                                              Number of analysed new started processes analysed:22
                                                                                                                                                                                                                              Number of new started drivers analysed:0
                                                                                                                                                                                                                              Number of existing processes analysed:0
                                                                                                                                                                                                                              Number of existing drivers analysed:0
                                                                                                                                                                                                                              Number of injected processes analysed:0
                                                                                                                                                                                                                              Technologies:
                                                                                                                                                                                                                              • HCA enabled
                                                                                                                                                                                                                              • EGA enabled
                                                                                                                                                                                                                              • AMSI enabled
                                                                                                                                                                                                                              Analysis Mode:default
                                                                                                                                                                                                                              Analysis stop reason:Timeout
                                                                                                                                                                                                                              Sample name:Build.exe
                                                                                                                                                                                                                              Detection:MAL
                                                                                                                                                                                                                              Classification:mal100.troj.spyw.evad.winEXE@32/23@5/5
                                                                                                                                                                                                                              EGA Information:
                                                                                                                                                                                                                              • Successful, ratio: 100%
                                                                                                                                                                                                                              HCA Information:
                                                                                                                                                                                                                              • Successful, ratio: 100%
                                                                                                                                                                                                                              • Number of executed functions: 179
                                                                                                                                                                                                                              • Number of non-executed functions: 2
                                                                                                                                                                                                                              Cookbook Comments:
                                                                                                                                                                                                                              • Found application associated with file extension: .exe
                                                                                                                                                                                                                              • Exclude process from analysis (whitelisted): MpCmdRun.exe, sppsvc.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
                                                                                                                                                                                                                              • Excluded IPs from analysis (whitelisted): 142.250.184.206, 142.250.186.67, 142.251.13.100, 142.251.13.139, 142.251.13.138, 142.251.13.102, 142.251.13.101, 142.251.13.113, 64.233.184.84, 142.250.186.142, 142.250.185.174, 20.109.210.53, 23.199.214.10
                                                                                                                                                                                                                              • Excluded domains from analysis (whitelisted): fs.microsoft.com, clients2.google.com, accounts.google.com, redirector.gvt1.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, clients.l.google.com, c.pki.goog, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                                                              • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                                              • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                                              • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                                              • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                                                              • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                                                              • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                                                                                                                              • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                                                                                                                                                              • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                                                                                                                              TimeTypeDescription
                                                                                                                                                                                                                              09:35:06API Interceptor77x Sleep call for process: Build.exe modified
                                                                                                                                                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                              34.117.59.81Document25.xlsmGet hashmaliciousScreenConnect Tool, AsyncRAT, StormKitty, VenomRATBrowse
                                                                                                                                                                                                                              • ipinfo.io/ip
                                                                                                                                                                                                                              brave.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                              • ipinfo.io//json
                                                                                                                                                                                                                              path.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                              • ipinfo.io/json
                                                                                                                                                                                                                              SecuriteInfo.com.Win64.Evo-gen.26839.29040.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                              • ipinfo.io/json
                                                                                                                                                                                                                              SecuriteInfo.com.Win64.Evo-gen.26839.29040.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                              • ipinfo.io/json
                                                                                                                                                                                                                              QkRFz2sau5.exeGet hashmaliciousAmadey, AsyncRAT, LiteHTTP Bot, LummaC Stealer, PureLog StealerBrowse
                                                                                                                                                                                                                              • ipinfo.io/ip
                                                                                                                                                                                                                              0t8amSU3vd.exeGet hashmaliciousCryptoWall, TrojanRansomBrowse
                                                                                                                                                                                                                              • ipinfo.io/ip
                                                                                                                                                                                                                              file.exeGet hashmaliciousInvicta Stealer, XWormBrowse
                                                                                                                                                                                                                              • ipinfo.io/json
                                                                                                                                                                                                                              Code%20Send%20meta%20Discord%20EXE.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                              • ipinfo.io/json
                                                                                                                                                                                                                              idl57nk7gk.exeGet hashmaliciousNeshtaBrowse
                                                                                                                                                                                                                              • ipinfo.io/json
                                                                                                                                                                                                                              104.26.0.100https://sp-track.info.socialmaud.digital/api/v1/track/click/355/30046/17/default/6b7d5c97-8b19-4c41-b355-64ecd84af44a?redirecturl=https://gamma.app/docs/POM-Technologies-Proposal-1tjhhormn8i5mpbGet hashmaliciousHTMLPhisher, Invisible JS, Tycoon2FABrowse
                                                                                                                                                                                                                                http://briefing-individual-construct.vercel.app/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                  https://newsletter-editor.poweredbyintegra.dk/?NewsLetterTracker=true&bio=holstebrony&newsletter_ID=1&Text=Eget%20billede%20(ingen%20mellemrum)&Code=106&utcmabite=f9d0de3f-59af-46e8-b932-e8ab5db62f67&biocode=holstebrony&RedirectUrl=moviepazes.com/gredso/80c1f3626fe2dec57456150d34de5b50/ZGF2aWQuc2VkbGlja0BvbmVhdGxhcy5jb20=Get hashmaliciousHTMLPhisher, Invisible JS, Tycoon2FABrowse
                                                                                                                                                                                                                                    Fw_ VN MSG 4_42_16 AM DURATION_0f0b5f5e889448e7c935c0db95b1d2a6.msgGet hashmaliciousHTMLPhisher, Invisible JS, Tycoon2FABrowse
                                                                                                                                                                                                                                      cndx.com.emlGet hashmaliciousHTMLPhisher, Invisible JS, Tycoon2FABrowse
                                                                                                                                                                                                                                        http://l0gin-check-acc0unt-metta-pagefb3464354674.xyz/live?432432432Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                          https://shorten.is/@viewnow4571953Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                            https://shorten.ee/businesspage-helpcenterGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                              Demande de proposition du MRC TRANSPORT INC.pdfGet hashmaliciousHTMLPhisher, Tycoon2FABrowse
                                                                                                                                                                                                                                                https://www.google.co.in/url?sa==qIZ4swYptEFjlFb1dUJMku8qkwo&rct=Tv6rwg5An5qVEcj21pbPddiYJMafw8MzCgW3o2BGMPiZkz1mDFVbk3KN5uvdm3gJdq&sa=t&url=amp/bortolassi.tajuamani.com./kkiq/lkik/gmLlwATlt4DqqG3BBbYOk/YmVydC53aWxrZXJzb25AbXlmbG9yaWRhcHJlcGFpZC5jb20=Get hashmaliciousHTMLPhisher, Tycoon2FABrowse
                                                                                                                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                                  ipinfo.iohttp://case-id-1000228256743.counselschambers.co.uk/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                  • 34.117.59.81
                                                                                                                                                                                                                                                  http://case-id-1000228256475.counselschambers.co.uk/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                  • 34.117.59.81
                                                                                                                                                                                                                                                  http://case-id-1000228254902.counselschambers.co.uk/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                  • 34.117.59.81
                                                                                                                                                                                                                                                  http://case-id-1000228251305.counselschambers.co.uk/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                  • 34.117.59.81
                                                                                                                                                                                                                                                  http://case-id-1000228270262.counselschambers.co.uk/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                  • 34.117.59.81
                                                                                                                                                                                                                                                  http://case-id-1000228255935.counselschambers.co.uk/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                  • 34.117.59.81
                                                                                                                                                                                                                                                  http://case-id-1000228287327.counselschambers.co.uk/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                  • 34.117.59.81
                                                                                                                                                                                                                                                  http://case-id-1000228263034.counselschambers.co.uk/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                  • 34.117.59.81
                                                                                                                                                                                                                                                  https://case-id-1000228252455.counselschambers.co.uk/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                  • 34.117.59.81
                                                                                                                                                                                                                                                  https://case-id-1000228256382.counselschambers.co.uk/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                  • 34.117.59.81
                                                                                                                                                                                                                                                  get.geojs.iohttp://t.go.rac.co.uk/r/?id=h1020a75,d7623c,1ac8b&p1=r%EF%BB%BF%EF%BB%BFe%EF%BB%BF%EF%BB%BFv%EF%BB%BF%EF%BB%BFi%EF%BB%BF%EF%BB%BFe%EF%BB%BF%EF%BB%BFw%EF%BB%BF%EF%BB%BFs%EF%BB%BF%EF%BB%BFt%EF%BB%BF%EF%BB%BFi%EF%BB%BF%EF%BB%BFp%EF%BB%BF%EF%BB%BFs%EF%BB%BF%EF%BB%BFa%EF%BB%BF%EF%BB%BFn%EF%BB%BF%EF%BB%BFd%EF%BB%BF%EF%BB%BFo%EF%BB%BF%EF%BB%BFf%EF%BB%BF%EF%BB%BFf%EF%BB%BF%EF%BB%BFe%EF%BB%BF%EF%BB%BFr%EF%BB%BF%EF%BB%BFs.com/sys/html/SNRgusxqYwmKT0SXMypB0/aW52ZXN0bWVudHNAZmlyc3RvbnRhcmlvLmNvbQ==Get hashmaliciousHTMLPhisher, Invisible JS, Tycoon2FABrowse
                                                                                                                                                                                                                                                  • 172.67.70.233
                                                                                                                                                                                                                                                  Play___New___VM___01min 10sec_____;-9415036076e8bac121c0e98c86740024257f1403349096ae54.htmGet hashmaliciousHTMLPhisher, Invisible JS, Tycoon2FABrowse
                                                                                                                                                                                                                                                  • 104.26.1.100
                                                                                                                                                                                                                                                  https://sp-track.info.socialmaud.digital/api/v1/track/click/355/30046/17/default/6b7d5c97-8b19-4c41-b355-64ecd84af44a?redirecturl=https://gamma.app/docs/POM-Technologies-Proposal-1tjhhormn8i5mpbGet hashmaliciousHTMLPhisher, Invisible JS, Tycoon2FABrowse
                                                                                                                                                                                                                                                  • 104.26.0.100
                                                                                                                                                                                                                                                  41QUE01 - TAX INVOICE - 7274916 from SFG (Brisbane).htmlGet hashmaliciousHTMLPhisher, Invisible JS, Tycoon2FABrowse
                                                                                                                                                                                                                                                  • 172.67.70.233
                                                                                                                                                                                                                                                  StormKittyXZeroTrace.exe.bin.exeGet hashmaliciousStormKittyBrowse
                                                                                                                                                                                                                                                  • 104.26.1.100
                                                                                                                                                                                                                                                  https://encryption-marinha.jkndfuzv.ru/PtM2i/$nadia.sofia.rijo@marinha.ptGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                  • 104.26.1.100
                                                                                                                                                                                                                                                  VM Orger Acknowledged.zipGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                  • 172.67.70.233
                                                                                                                                                                                                                                                  http://briefing-individual-construct.vercel.app/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                                  • 104.26.0.100
                                                                                                                                                                                                                                                  https://newsletter-editor.poweredbyintegra.dk/?NewsLetterTracker=true&bio=holstebrony&newsletter_ID=1&Text=Eget%20billede%20(ingen%20mellemrum)&Code=106&utcmabite=f9d0de3f-59af-46e8-b932-e8ab5db62f67&biocode=holstebrony&RedirectUrl=moviepazes.com/gredso/80c1f3626fe2dec57456150d34de5b50/ZGF2aWQuc2VkbGlja0BvbmVhdGxhcy5jb20=Get hashmaliciousHTMLPhisher, Invisible JS, Tycoon2FABrowse
                                                                                                                                                                                                                                                  • 104.26.0.100
                                                                                                                                                                                                                                                  https://vwj9ymusjv9xeh65cf602u2rmsnkbyf2u7lxtnawlaim1gvceu.moydow.de/5417971987/6327230191/#bnBkL3NmdW9mZGJvYnlmdUFob2p0Ymlkc3ZxJTBsU3RkM0cwdnMvbmJmeXN1VGZ1ekMvezJsdWZxUFhXV0wyNVRmOXZqWkk5eUZbbXJie04xTTZIREp2cGN5dTlRMzplOFZkVEQwMDt0cXV1aQ==Get hashmaliciousHTMLPhisher, Invisible JS, Tycoon2FABrowse
                                                                                                                                                                                                                                                  • 104.26.1.100
                                                                                                                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                                  CLOUDFLARENETUScrypted.41.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                                                  • 104.21.32.1
                                                                                                                                                                                                                                                  alexx111.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                                                  • 104.21.48.1
                                                                                                                                                                                                                                                  work.jsGet hashmaliciousAmadey, LummaC Stealer, PureLog Stealer, Stealc, VidarBrowse
                                                                                                                                                                                                                                                  • 172.67.212.102
                                                                                                                                                                                                                                                  h2wb5_002.exeGet hashmaliciousDarkVision RatBrowse
                                                                                                                                                                                                                                                  • 104.26.9.202
                                                                                                                                                                                                                                                  v7942.exeGet hashmaliciousStealc, VidarBrowse
                                                                                                                                                                                                                                                  • 172.64.41.3
                                                                                                                                                                                                                                                  dBKUxeI.exeGet hashmaliciousAsyncRAT, DarkVision RatBrowse
                                                                                                                                                                                                                                                  • 172.67.68.246
                                                                                                                                                                                                                                                  ADFoyxP.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                  • 104.21.64.1
                                                                                                                                                                                                                                                  b0hgYat.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                  • 172.67.74.152
                                                                                                                                                                                                                                                  random.exeGet hashmaliciousAmadey, LummaC Stealer, Stealc, XmrigBrowse
                                                                                                                                                                                                                                                  • 104.21.80.1
                                                                                                                                                                                                                                                  7T7bCyA.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                                                  • 104.21.96.1
                                                                                                                                                                                                                                                  GOOGLE-AS-APGoogleAsiaPacificPteLtdSGrandom.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                  • 34.117.188.166
                                                                                                                                                                                                                                                  random.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                  • 34.117.188.166
                                                                                                                                                                                                                                                  KKveTTgaAAsecNNaaaa.spc.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                  • 34.117.111.68
                                                                                                                                                                                                                                                  KKveTTgaAAsecNNaaaa.arm7.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                                                  • 34.65.20.104
                                                                                                                                                                                                                                                  http://case-id-1000228256743.counselschambers.co.uk/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                  • 34.117.59.81
                                                                                                                                                                                                                                                  http://case-id-1000228256475.counselschambers.co.uk/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                  • 34.117.59.81
                                                                                                                                                                                                                                                  http://case-id-1000228254902.counselschambers.co.uk/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                  • 34.117.59.81
                                                                                                                                                                                                                                                  http://case-id-1000228251305.counselschambers.co.uk/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                  • 34.117.59.81
                                                                                                                                                                                                                                                  http://case-id-1000228270262.counselschambers.co.uk/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                  • 34.117.59.81
                                                                                                                                                                                                                                                  http://case-id-1000228255935.counselschambers.co.uk/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                  • 34.117.59.81
                                                                                                                                                                                                                                                  AS-COLOCROSSINGUSh2wb5_002.exeGet hashmaliciousDarkVision RatBrowse
                                                                                                                                                                                                                                                  • 104.168.28.10
                                                                                                                                                                                                                                                  dBKUxeI.exeGet hashmaliciousAsyncRAT, DarkVision RatBrowse
                                                                                                                                                                                                                                                  • 104.168.28.10
                                                                                                                                                                                                                                                  random.exeGet hashmaliciousAmadey, LummaC Stealer, Stealc, XmrigBrowse
                                                                                                                                                                                                                                                  • 107.174.192.179
                                                                                                                                                                                                                                                  earereallyniceloverwithgreatthingsonthatkissinggirlonme.htaGet hashmaliciousRemcosBrowse
                                                                                                                                                                                                                                                  • 172.245.191.88
                                                                                                                                                                                                                                                  goodmanwnatgoodthingsforbesthings.htaGet hashmaliciousCobalt Strike, MSIL Logger, MassLogger RATBrowse
                                                                                                                                                                                                                                                  • 192.3.101.146
                                                                                                                                                                                                                                                  Our Order.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                  • 198.12.89.24
                                                                                                                                                                                                                                                  ienetstatgoodforkissing.htaGet hashmaliciousCobalt Strike, DBatLoader, MSIL Logger, MassLogger RAT, PureLog StealerBrowse
                                                                                                                                                                                                                                                  • 192.227.228.22
                                                                                                                                                                                                                                                  Proof of Payment and Statement.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                  • 192.227.228.22
                                                                                                                                                                                                                                                  APC2_240708172813545null_847608629.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                  • 23.95.235.28
                                                                                                                                                                                                                                                  FORMULARZ ODPRAWY CELNEJ DHL.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                  • 23.95.235.28
                                                                                                                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                                  3b5074b1b5d032e5620f69f9f700ff0eputikatest.jsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                  • 34.117.59.81
                                                                                                                                                                                                                                                  • 104.26.0.100
                                                                                                                                                                                                                                                  putikatest.jsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                  • 34.117.59.81
                                                                                                                                                                                                                                                  • 104.26.0.100
                                                                                                                                                                                                                                                  ADFoyxP.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                  • 34.117.59.81
                                                                                                                                                                                                                                                  • 104.26.0.100
                                                                                                                                                                                                                                                  DownloadSDKServer.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                  • 34.117.59.81
                                                                                                                                                                                                                                                  • 104.26.0.100
                                                                                                                                                                                                                                                  Purchase Order Braiconf SA #U2013 26.09.2024.batGet hashmaliciousAsyncRAT, Batch Injector, VenomRATBrowse
                                                                                                                                                                                                                                                  • 34.117.59.81
                                                                                                                                                                                                                                                  • 104.26.0.100
                                                                                                                                                                                                                                                  Order.jsGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                                                                                  • 34.117.59.81
                                                                                                                                                                                                                                                  • 104.26.0.100
                                                                                                                                                                                                                                                  Shipping documents.pdf.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                  • 34.117.59.81
                                                                                                                                                                                                                                                  • 104.26.0.100
                                                                                                                                                                                                                                                  QUOTATION_MARQUOTE312025PDF.scr.exeGet hashmaliciousMSIL LoggerBrowse
                                                                                                                                                                                                                                                  • 34.117.59.81
                                                                                                                                                                                                                                                  • 104.26.0.100
                                                                                                                                                                                                                                                  Documento de env#U00edo de factura (DHL).exeGet hashmaliciousDarkCloudBrowse
                                                                                                                                                                                                                                                  • 34.117.59.81
                                                                                                                                                                                                                                                  • 104.26.0.100
                                                                                                                                                                                                                                                  ienetstatgoodforkissing.htaGet hashmaliciousCobalt Strike, DBatLoader, MSIL Logger, MassLogger RAT, PureLog StealerBrowse
                                                                                                                                                                                                                                                  • 34.117.59.81
                                                                                                                                                                                                                                                  • 104.26.0.100
                                                                                                                                                                                                                                                  No context
                                                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\Build.exe
                                                                                                                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                  Size (bytes):1525
                                                                                                                                                                                                                                                  Entropy (8bit):5.343808730969294
                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                  SSDEEP:24:ML9E4KlKDE4KhKiKhWE4KYE4mKIE4oKNzKoZAE4KzebE4qpsXE4qdKf1qE4jE4Ks:MxHKlYHKh3oWHKYHmtHo6hAHKzebHpHe
                                                                                                                                                                                                                                                  MD5:D69FC575539AF943458B6D4ED406DA05
                                                                                                                                                                                                                                                  SHA1:A9EB603191AA181A4D6B771184D2AE98416DAC9B
                                                                                                                                                                                                                                                  SHA-256:891D6651A7AC0C913798F4CF03E3FBAD14FA755D6F5C00B8F0075510955E8D6C
                                                                                                                                                                                                                                                  SHA-512:0CBDDB62F19EEBA57EB57800A27A23D1333CEBE994457D4B08184DDC2F8886016907717733EC671F8A481E34A0B5A9D036762CBE687C33ED7E31C837F37A96B1
                                                                                                                                                                                                                                                  Malicious:true
                                                                                                                                                                                                                                                  Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..2,"System.IO.Compression, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e
                                                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\Build.exe
                                                                                                                                                                                                                                                  File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                  Size (bytes):679410
                                                                                                                                                                                                                                                  Entropy (8bit):7.997817006230619
                                                                                                                                                                                                                                                  Encrypted:true
                                                                                                                                                                                                                                                  SSDEEP:12288:J08crApCZsZGTKaBwR/GWzIuqBER2keD2z9WXP5oHhfUbEpz3HXgB:JkUpCSZkBW/au+Ek1i/tFw
                                                                                                                                                                                                                                                  MD5:01E1D652A1E9A049D68E478071321454
                                                                                                                                                                                                                                                  SHA1:7CFAC6159378E86E512CB2B6E7C8E3EC19D28C74
                                                                                                                                                                                                                                                  SHA-256:6C4B6C0622D38DC86B67A956F4A9DB71E25A9774AE38B4091040F1719F8AD0EB
                                                                                                                                                                                                                                                  SHA-512:BE579BE59B360C8CC4B480C61BD780BC9A4536CC7AE6215C218DBB23D54F887124A9ED4E7D43A6C6E54B4E65D7B46B44AB13B60152F84569361231E3E7161281
                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                  Preview:PK........fLoZ?.fj{D..h...".$.8.46.123.189/DesktopScreenshot.png.. ..............................\{y<....g31*...LV...96T.2r.\S.%D.1".[.bS.....}F...........c....|....|?........<......)...[..H....O...64.o .[..@.w...M.j7... .u..x(...m7.8]...5;g...Q.......S..73/....S.<.\.tY.\.6yZ.E.qAm..O.0......G.8.6).&=..[7....-k.>k..^m....$..N5..-......z\......F..O.....,.7..g.NW.h.M.N..I......+..=.9.P..."......E.....GHU1.i.h.G........d....#fQ}lE....#..8........u.*o.......&w.3...am...~...I.z......~.Jci.|.~................%..U.....AG..mQ.....GK_..8......_\u....=pt....k.:........!R.:...C....?...og...*tA..i.J.....0'.3....qb...R......s.......P...Bnq......A.ffUS]$.).....(UC.NA......A..C.<!P....N?..3.......{{m6"z.zMA.H.B.U&....z..0.L...........FH..]].%"\.mSc...x.....z..F...'.].....Vj..TX<.z.9{`S'...M.....W.?.'NW..b3.{.'.E..d...!.R.#.+.nD*..*..v|L.\..Dv....~m..........;..'{..t........0..g....>\.K)s^.m1.....H.B....T.l.aop{..F.i0m...aL...%%.Bg....95....
                                                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\Build.exe
                                                                                                                                                                                                                                                  File Type:ASCII text
                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                  Size (bytes):105
                                                                                                                                                                                                                                                  Entropy (8bit):3.8863455911790052
                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                  SSDEEP:3:RGtjybXLGSWK+ZjMGvRS3ZMz9GSOLj2SjyRE2qJ:hvWF7Ipg9OL2RE2m
                                                                                                                                                                                                                                                  MD5:2E9D094DDA5CDC3CE6519F75943A4FF4
                                                                                                                                                                                                                                                  SHA1:5D989B4AC8B699781681FE75ED9EF98191A5096C
                                                                                                                                                                                                                                                  SHA-256:C84C98BBF5E0EF9C8D0708B5D60C5BB656B7D6BE5135D7F7A8D25557E08CF142
                                                                                                                                                                                                                                                  SHA-512:D1F7EED00959E902BDB2125B91721460D3FF99F3BDFC1F2A343D4F58E8D4E5E5A06C0C6CDC0379211C94510F7C00D7A8B34FA7D0CA0C3D54CBBE878F1E9812B7
                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                  Preview:### Get Help ###.### Customize Firefox ###.### Get Involved ###.### About Us ###.### Getting Started ###.
                                                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\Build.exe
                                                                                                                                                                                                                                                  File Type:PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                  Size (bytes):691048
                                                                                                                                                                                                                                                  Entropy (8bit):7.929286239427818
                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                  SSDEEP:12288:tf5FxStRlJuZwtr74oCDqsy5JUafr8iPbrJLimJF3RxHnkHAjW8n1nq2wD+r:J5FxStR6a7VJT4iPbPF3RxoOtJq2wSr
                                                                                                                                                                                                                                                  MD5:EFE884D5B5444248622E0859F1BE06D2
                                                                                                                                                                                                                                                  SHA1:618910D7065892B7C90939406DA5F736AF50614E
                                                                                                                                                                                                                                                  SHA-256:A143A77774EA2C75DE351C7062DAFBE6F6A018C6AF0923B45C1C013468AA1EBB
                                                                                                                                                                                                                                                  SHA-512:B013B7CC58F3339373B3AB81FC27A177D6C328F832FED615885E70253DAA3BE7BB7C4E1D83499E03C8326F90EF4CBB2A16B2013409BEA8CE1EBD2BB6A4D210BA
                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                  Preview:.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^....]...}.Q.jt..q...*Ww.q...q+.....U...0Q."'.l..9b.mLN..$........Q. D. @.A(#..l....\....v:{.I....1...7.Z{.a...7.......&lhB...[Q...njK....va..qFM.......p..(.......'c..e..a......%.+...o.....k{b......l.N_.Y..Y.....5-....m..)..~...TP?qe..~S;..8~..[Q1.#.c_..0.|...R..s]1.Q...}kY....o..A..K[2.u..w@.kq.Q0..g+..z.{.................-......._..#.....y=P......m....}.v.3..d..>..z,1...O<....O=..s4V,.C..G.........x..>T1...G`.-.....G....}8..~h...y01...%f..a.P.P..'..G...B......\?..c\k....a.C..xd..^%.5..C.Oh<p.*6.......=../..ro.......M8....x..a.!1....Y.......7..X.j./H}......c...i'..(L.9.b;.X..H^....'.1.......Z.....!.C./......0../..;?Q..*6y.0.o..\......}..'...;..........>w...wV0....k....)o....C...F.ZZb.O..ub.....;..+6.w....^w&..s....{.....3oO..qG....l...w%.<b.3....#.L.=.'...7B.>.j....3......f.5...q}l5....v.-.N..}b.....&........k;.....j..b.....s......bR.
                                                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\Build.exe
                                                                                                                                                                                                                                                  File Type:ASCII text
                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                  Size (bytes):380
                                                                                                                                                                                                                                                  Entropy (8bit):5.411700719820245
                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                  SSDEEP:6:R0UUtL558mXRNhVRJvcbUveLlRo1NAj1h4BjA9YutcqNgPZxwzODy8A7/n:R0UwPRbVkb2Gcuxa2Y6JyPjjyR
                                                                                                                                                                                                                                                  MD5:3A31FCDE37201C225B3616657A1F36BF
                                                                                                                                                                                                                                                  SHA1:82D80583840DDF6BCB83EA26A69F929DA4A19B90
                                                                                                                                                                                                                                                  SHA-256:63F785F70FE0BEE61215333E5E1F48F77ED3DD31DEE87F130467AE9F8ED454D6
                                                                                                                                                                                                                                                  SHA-512:17627C8AA62D6DFC977BA3F8009BA9661D02C011B5357C79D5D844DE1CC6CB6FF674ABD2FBA8A486701C37ED8118639AC6BC7B039BF5B6C62D43A2ECEB332DF9
                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                  Preview:.[IP].Internal IP: No network adapters with an IPv4 address in the system!.Gateway IP: 192.168.2.1..[Machine].Username: user.Compname: 536720.System: Microsoft Windows 10 Pro (64 Bit).CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz.GPU: 48ZTZ.RAM: 4095MB.DATE: 2025-03-15 9:35:21 am.SCREEN: 1280x1024.BATTERY: NoSystemBattery (100%)..[Virtualization].Antivirus: Windows Defender.
                                                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\Build.exe
                                                                                                                                                                                                                                                  File Type:ASCII text
                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                  Size (bytes):19326
                                                                                                                                                                                                                                                  Entropy (8bit):5.807289160995539
                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                  SSDEEP:384:WJlR1TA7telEtRNUeIev+8iAwCvAYMLHA+IyhAFUMmrEMXOcfMpK2xJYvkengUlR:ETFuRO8JYMxGajoBB
                                                                                                                                                                                                                                                  MD5:2B6A106D96E35E4A24837077BB07685C
                                                                                                                                                                                                                                                  SHA1:F5D34C0E2DBEB78FAE77E7DE45AC241D8FFD06D6
                                                                                                                                                                                                                                                  SHA-256:FD0A0FC40378B02FA5D14483A5CB77C0BF5E92444957577FFD3CB6FA73702243
                                                                                                                                                                                                                                                  SHA-512:1575B7EE148A29E0ED882C5A916293DFFA25D4E0ED5403E5367EC1E5CB83D22476303EB64120D8B61AE0A9CE50764228E97526F6AA25EDE495902F14DA36C6CC
                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                  Preview:NAME: kXYwFxK23d1H1aS5..PID: 6892..EXE: C:\Program Files (x86)\PhQGigHoLVYvmCaOPdyrgGIclALdinTrrkCTttFfyHOYEIqGbjIyCXPaLCBuOjXjdddSemRKil\kXYwFxK23d1H1aS5.exe..NAME: sdi0WHl5BGgs..PID: 6028..EXE: C:\Program Files (x86)\PhQGigHoLVYvmCaOPdyrgGIclALdinTrrkCTttFfyHOYEIqGbjIyCXPaLCBuOjXjdddSemRKil\sdi0WHl5BGgs.exe..NAME: yc5cLUbxRjExz4Herx..PID: 5628..EXE: C:\Program Files (x86)\PhQGigHoLVYvmCaOPdyrgGIclALdinTrrkCTttFfyHOYEIqGbjIyCXPaLCBuOjXjdddSemRKil\yc5cLUbxRjExz4Herx.exe..NAME: lRE8WlpW3YIbfyNPr..PID: 1716..EXE: C:\Program Files (x86)\PhQGigHoLVYvmCaOPdyrgGIclALdinTrrkCTttFfyHOYEIqGbjIyCXPaLCBuOjXjdddSemRKil\lRE8WlpW3YIbfyNPr.exe..NAME: RuntimeBroker..PID: 4732..EXE: C:\Windows\System32\RuntimeBroker.exe..NAME: DVnZMpozPSQ0yLS..PID: 6452..EXE: C:\Program Files (x86)\PhQGigHoLVYvmCaOPdyrgGIclALdinTrrkCTttFfyHOYEIqGbjIyCXPaLCBuOjXjdddSemRKil\DVnZMpozPSQ0yLS.exe..NAME: csrss..PID: 412..EXE: ..NAME: sihost..PID: 3424..EXE: C:\Windows\system32\sihost.exe..NAME: svchost..PID: 1692..EXE: C:\Wi
                                                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\Build.exe
                                                                                                                                                                                                                                                  File Type:ASCII text
                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                  Size (bytes):5566
                                                                                                                                                                                                                                                  Entropy (8bit):5.332950303042474
                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                  SSDEEP:48:bWD2s+HKLrHFvdJqIYIE8o1+2FfyWtJBozCrNaexcKvcXh2rlfFM:bi27HW78ITg1+qauJBozCrNOaOkG
                                                                                                                                                                                                                                                  MD5:C385663104981155ADD9EF89DF62CBD3
                                                                                                                                                                                                                                                  SHA1:67A9EE20D1DA8005FA48E0E74C125B3E08EE054C
                                                                                                                                                                                                                                                  SHA-256:B44CB463B2FEB11C3CAB613B208B85DB64D09FAC1A6B36474DD265557D72FC88
                                                                                                                                                                                                                                                  SHA-512:2590328509BF4817F6AD1F91C418E70F4B45C5F69210EEC0D00004939AFF0C51CDDDFFAEF0AE254F2B6469A1463C06D2DDF3C1FD05DF5F85DF421EAC8EA38AA1
                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                  Preview:NAME: kXYwFxK23d1H1aS5..TITLE: New Tab - Google Chrome..PID: 6892..NAME: sdi0WHl5BGgs..TITLE: New Tab - Google Chrome..PID: 6028..NAME: yc5cLUbxRjExz4Herx..TITLE: New Tab - Google Chrome..PID: 5628..NAME: lRE8WlpW3YIbfyNPr..TITLE: New Tab - Google Chrome..PID: 1716..NAME: DVnZMpozPSQ0yLS..TITLE: New Tab - Google Chrome..PID: 6452..NAME: 5AJga9CHk9pJMk3..TITLE: New Tab - Google Chrome..PID: 1664..NAME: enq3sEFJxVPRbkd8y5gQ..TITLE: New Tab - Google Chrome..PID: 4680..NAME: 0536Y0zmTPQj..TITLE: New Tab - Google Chrome..PID: 2524..NAME: qJim0cY8dr6jVhiW..TITLE: New Tab - Google Chrome..PID: 5540..NAME: 9HYvPhJFVtrB..TITLE: New Tab - Google Chrome..PID: 796..NAME: GUWbvkc0udbE..TITLE: New Tab - Google Chrome..PID: 5532..NAME: ozgVzGEqr..TITLE: New Tab - Google Chrome..PID: 6824..NAME: 1g52nHj1A..TITLE: New Tab - Google Chrome..PID: 6808..NAME: cAYtK7kR3D..TITLE: New Tab - Google Chrome..PID: 5508..NAME: bOov2hPes..TITLE: New Tab - Google Chrome..PID: 2284..NAME: iBoAFYA0krXzUACVuyO..TITLE:
                                                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\Build.exe
                                                                                                                                                                                                                                                  File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                  Size (bytes):1833
                                                                                                                                                                                                                                                  Entropy (8bit):5.03918718986289
                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                  SSDEEP:48:9wgweItmqoOY7+EDvFHFwDRhKyKu8jQYld:qgatY+EzFHOVcZugvld
                                                                                                                                                                                                                                                  MD5:6D1ABAA92731199396FE6983FEFCB962
                                                                                                                                                                                                                                                  SHA1:EC89A97B21CA1F8AC903A86F81EEA943F0387023
                                                                                                                                                                                                                                                  SHA-256:C444B4CE1BDE688648B6251A4FEF0346B3E4C62A8AF9DCC7DBC598289A8CAE78
                                                                                                                                                                                                                                                  SHA-512:056E76D8BE3F30B56A0EE252CEC866B0BF0B2DE53CB4BF0FB6599181602601B08E34E57806E861EF41D5BA444D69E52FF999D5C6179A3FC6460D68CD95610318
                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                  Preview:PK.........MoZ.X...........H.Information.txt.. ................................... ................................... .. ----- Geolocation Data -----....IP: 8.46.123.189..Country: United States (US)..City: New York..Postal: 3356..MAC: EC:F4:BB:82:F7:E0.... ----- Hardware Info -----....Username: user\536720 ..Windows name: Windows 10 Enterprise x64..Hardware ID: cbb6c30fb85778d698926a2f54c51596..GPU: 48ZTZ..CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..RAM: 4 GB.... ----- Report Contents -----....Passwords: 0..Cookies: 0..Credit Cards: 0..AutoFills: 0..Extensions: 0..Wallets: 0..Files: 0.......... ----- Miscellaneous -----....Antivirus products: Windows Defender..File Location
                                                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\Build.exe
                                                                                                                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                  Size (bytes):51200
                                                                                                                                                                                                                                                  Entropy (8bit):0.8746135976761988
                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                  SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                                                                                                                                                                                                  MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                                                                                                                                                                                                  SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                                                                                                                                                                                                  SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                                                                                                                                                                                                  SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                  Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\Build.exe
                                                                                                                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                  Size (bytes):155648
                                                                                                                                                                                                                                                  Entropy (8bit):0.5407252242845243
                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                  SSDEEP:96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
                                                                                                                                                                                                                                                  MD5:7B955D976803304F2C0505431A0CF1CF
                                                                                                                                                                                                                                                  SHA1:E29070081B18DA0EF9D98D4389091962E3D37216
                                                                                                                                                                                                                                                  SHA-256:987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
                                                                                                                                                                                                                                                  SHA-512:CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                  Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\Build.exe
                                                                                                                                                                                                                                                  File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                  Size (bytes):5242880
                                                                                                                                                                                                                                                  Entropy (8bit):0.03786218306281921
                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                  SSDEEP:192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
                                                                                                                                                                                                                                                  MD5:4BB4A37B8E93E9B0F5D3DF275799D45E
                                                                                                                                                                                                                                                  SHA1:E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
                                                                                                                                                                                                                                                  SHA-256:89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
                                                                                                                                                                                                                                                  SHA-512:F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                  Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\Build.exe
                                                                                                                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 2, database pages 20, cookie 0xc, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                  Size (bytes):40960
                                                                                                                                                                                                                                                  Entropy (8bit):0.8616778647394084
                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                  SSDEEP:48:pMtA+IIkCVEq8Ma0D0HOlf/6ykwpLf/UUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:pOCCn8MouB6w9f/MiZqmvJKLPeymwil
                                                                                                                                                                                                                                                  MD5:BDDE4AD11E732420E7ABCCA946B11611
                                                                                                                                                                                                                                                  SHA1:278C3386A37BAFCA507CF4C128600B01B312DDA0
                                                                                                                                                                                                                                                  SHA-256:099AB6B902097361832FC2485E96C71C827E722FA74C09C7D08DCE9091094C1D
                                                                                                                                                                                                                                                  SHA-512:B29061A507FCAE2CB56155C5C911706E60C798D288968B210A1670C0F0D1D3F7B3B2B2919B946FED47C4975B157A56B557F71AE80A427C85C660F6B37153C9E8
                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                  Preview:SQLite format 3......@ ..........................................................................zp....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\Build.exe
                                                                                                                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3046000, file counter 2, database pages 41, 1st free page 29, free pages 1, cookie 0x25, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                  Size (bytes):196608
                                                                                                                                                                                                                                                  Entropy (8bit):0.45909911068154247
                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                  SSDEEP:96:OpdTxQ+ALqL/uejzH+bF+UIYysX0lj/twfLyl0e9S8E:OpdT7IqL/tH+bF+UI3i67Kylj9
                                                                                                                                                                                                                                                  MD5:89783266A93C429FCFB9CE049053FCCD
                                                                                                                                                                                                                                                  SHA1:AC70D1404CB8588DBB685165154CA6FD01942CCE
                                                                                                                                                                                                                                                  SHA-256:AF2420C3F982037DA346ACB0722E54A466547DCCFC54C44EA84FBC1401DC15BC
                                                                                                                                                                                                                                                  SHA-512:BD3C480D62EDF9CA8F23BB17E39405E9EE2EE705EEE832F738D4C3AE5C16E3317A1822C07373CB49A8E704B3DA3D7BDC95544208C1C369322E7F8CE2E2DE93CF
                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                  Preview:SQLite format 3......@ .......)...........%......................................................zp....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\Build.exe
                                                                                                                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3046000, file counter 2, database pages 41, 1st free page 29, free pages 1, cookie 0x25, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                  Size (bytes):196608
                                                                                                                                                                                                                                                  Entropy (8bit):0.45909911068154247
                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                  SSDEEP:96:OpdTxQ+ALqL/uejzH+bF+UIYysX0lj/twfLyl0e9S8E:OpdT7IqL/tH+bF+UI3i67Kylj9
                                                                                                                                                                                                                                                  MD5:89783266A93C429FCFB9CE049053FCCD
                                                                                                                                                                                                                                                  SHA1:AC70D1404CB8588DBB685165154CA6FD01942CCE
                                                                                                                                                                                                                                                  SHA-256:AF2420C3F982037DA346ACB0722E54A466547DCCFC54C44EA84FBC1401DC15BC
                                                                                                                                                                                                                                                  SHA-512:BD3C480D62EDF9CA8F23BB17E39405E9EE2EE705EEE832F738D4C3AE5C16E3317A1822C07373CB49A8E704B3DA3D7BDC95544208C1C369322E7F8CE2E2DE93CF
                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                  Preview:SQLite format 3......@ .......)...........%......................................................zp....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\Build.exe
                                                                                                                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 4, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                  Size (bytes):139264
                                                                                                                                                                                                                                                  Entropy (8bit):1.1353454741604
                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                  SSDEEP:192:elsfoVZkNi61n1ulH5mpX67oVuZVPqfPk:elsfoQx1n1ulH5umoVuZVPqfM
                                                                                                                                                                                                                                                  MD5:D2A4025F32C5C6B3F294F7ECC10DD371
                                                                                                                                                                                                                                                  SHA1:9EFC8B64F96F1D36D8C8AA14286B2FC8E0557C47
                                                                                                                                                                                                                                                  SHA-256:D954F165A5E9B85DED33C1727606EA1A3209FA7E724493B4F64053E171DB414F
                                                                                                                                                                                                                                                  SHA-512:5774023D161B6EB6495361A302F16681144FD12FBC3DE09DB6826EEAB28E2DC0FF36B966FB6BF064A6F7FF3DBA77E0148208FF3D4BA44297ADAAD8B656106296
                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                  Preview:SQLite format 3......@ .......D...........J......................................................zp...........<........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\Build.exe
                                                                                                                                                                                                                                                  File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                  Size (bytes):98304
                                                                                                                                                                                                                                                  Entropy (8bit):0.08235737944063153
                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                  SSDEEP:12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
                                                                                                                                                                                                                                                  MD5:369B6DD66F1CAD49D0952C40FEB9AD41
                                                                                                                                                                                                                                                  SHA1:D05B2DE29433FB113EC4C558FF33087ED7481DD4
                                                                                                                                                                                                                                                  SHA-256:14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
                                                                                                                                                                                                                                                  SHA-512:771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                  Preview:SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\Build.exe
                                                                                                                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                  Size (bytes):196608
                                                                                                                                                                                                                                                  Entropy (8bit):1.1215401507481708
                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                  SSDEEP:384:72qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:qq+n0E9ELyKOMq+8HKkjuczRv89
                                                                                                                                                                                                                                                  MD5:4B7413BC9D2D60F801777DE457B19F3D
                                                                                                                                                                                                                                                  SHA1:708BBAC7E9CF6448CBA5AD64C0F7DCF4DFF3355F
                                                                                                                                                                                                                                                  SHA-256:DB9A12C7F30F936B06EEED870E949CF9C2B67EEC18EEFAA62658CE1A8DA8FE19
                                                                                                                                                                                                                                                  SHA-512:71F7472F7918F59BB17F82C6A4B784D6742E7E2683DE4C5D60186664A5E304A21EEF4F8C88E7FC852B207876EC9D3EE963F4805C329FD07F8A4B93A0E3C43021
                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                  Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                  File Type:ASCII text
                                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                                  Size (bytes):29
                                                                                                                                                                                                                                                  Entropy (8bit):3.9353986674667634
                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                  SSDEEP:3:VQAOx/1n:VQAOd1n
                                                                                                                                                                                                                                                  MD5:6FED308183D5DFC421602548615204AF
                                                                                                                                                                                                                                                  SHA1:0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
                                                                                                                                                                                                                                                  SHA-256:4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
                                                                                                                                                                                                                                                  SHA-512:A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                  URL:https://www.google.com/async/newtab_promos
                                                                                                                                                                                                                                                  Preview:)]}'.{"update":{"promos":{}}}
                                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (65531)
                                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                                  Size (bytes):131658
                                                                                                                                                                                                                                                  Entropy (8bit):5.43808678797082
                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                  SSDEEP:3072:M+ZkDj4BST/k4ZYSTVcxhNkaZI4RpTh6z6x0zW:jqjLT/k4ZYSTVcxhNkaZI4RpTh46AW
                                                                                                                                                                                                                                                  MD5:B4FC6EDD2C8AD3D32058E4C6A2922765
                                                                                                                                                                                                                                                  SHA1:ED6085BA425F4BB086F05FED444BDF869E994ACE
                                                                                                                                                                                                                                                  SHA-256:7FE02A5829667C41E54F2CAC483AC92967A11609D918B7904505E9C197F1A7A9
                                                                                                                                                                                                                                                  SHA-512:409B947BAF642CE07F34E792626FD1C6DC07AE15136776031D9CD6DF5524545F8287A7051C09BC784F560E7BAA79E2624B3DFCF6A688035782B5D1C84B7D3D2D
                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                  URL:https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
                                                                                                                                                                                                                                                  Preview:)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Fa gb_2d gb_Pe gb_rd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Qd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_ld gb_pd gb_Hd gb_md\"\u003e\u003cdiv class\u003d\"gb_xd gb_sd\"\u003e\u003cdiv class\u003d\"gb_Kc gb_R\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Kc gb_Nc gb_R\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.
                                                                                                                                                                                                                                                  Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (6030)
                                                                                                                                                                                                                                                  Category:downloaded
                                                                                                                                                                                                                                                  Size (bytes):6035
                                                                                                                                                                                                                                                  Entropy (8bit):5.799840110226752
                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                  SSDEEP:96:58lL7H6666rgihNsOXBioNiPe1/tCp7jeLaq6mE5S4x+H6666zQATG/ref1cNFdi:5KL7H66668ihNsOPN4Cy7jesmAGH666K
                                                                                                                                                                                                                                                  MD5:65B6562F771FEA131B331FACF5E84ECD
                                                                                                                                                                                                                                                  SHA1:83F56CED1A582B8BDBB54FEF83C3A00B1A175112
                                                                                                                                                                                                                                                  SHA-256:6CAA053A2E008EAE09B72691B55E778AB8B72AA0165CAB2148EB88781443BAF1
                                                                                                                                                                                                                                                  SHA-512:DCE7A90E0908F2F0A026010282B816CD174C1FC13FEC404BD2469EF170843D6945B94B4D6AD124500465E5AD9F85BAF946B9B736792E4CA9003215B86CC3FEE3
                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                  URL:https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE
                                                                                                                                                                                                                                                  Preview:)]}'.["",["toronto maple leafs","nyt strands hints march 15","monster hunter wilds","antarctica map","joann gift cards","new movies streaming","ole miss wyatt thistle death","genshin impact 5.5 livestream codes"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChoIkk4SFQoRVHJlbmRpbmcgc2VhcmNoZXMoCg\u003d\u003d","google:suggestdetail":[{"google:entityinfo":"CggvbS8wajZ0chIPSWNlIGhvY2tleSB0ZWFtMr8RZGF0YTppbWFnZS9qcGVnO2Jhc2U2NCwvOWovNEFBUVNrWkpSZ0FCQVFBQUFRQUJBQUQvMndDRUFBa0dCd2dIQmdrSUJ3Z0tDZ2tMRFJZUERRd01EUnNVRlJBV0lCMGlJaUFkSHg4a0tEUXNKQ1l4Sng4ZkxUMHRNVFUzT2pvNkl5cy9SRDg0UXpRNU9qY0JDZ29LRFF3TkdnOFBHamNsSHlVM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOLy9BQUJFSUFFQUFRQU1CSWdBQ0VRRURFUUgveEFBY0FBQUNBZ01CQVFBQUFBQUFBQUFBQUFBRkJ3QUlBd1FHQWdIL3hBQXZFQUFDQVFNREFnUUdBZ0lEQUFBQUFBQUJBZ01FQlJFQUVpRUdNUk1pUVZFVU1rSmhjWUVISTNMaGtjSHcvOFFBR1FFQUF3RUJBUUFBQUFBQUFBQUFBQUFBQUFNRUFRVUMvOFFBSXhFQUFRUUNBZ0VGQVFB
                                                                                                                                                                                                                                                  File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                                  Entropy (8bit):5.934482692932365
                                                                                                                                                                                                                                                  TrID:
                                                                                                                                                                                                                                                  • Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                                                                                                                                                                                                                                                  • Win32 Executable (generic) a (10002005/4) 49.75%
                                                                                                                                                                                                                                                  • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                                                                                                                                                                                                                  • Windows Screen Saver (13104/52) 0.07%
                                                                                                                                                                                                                                                  • Generic Win/DOS Executable (2004/3) 0.01%
                                                                                                                                                                                                                                                  File name:Build.exe
                                                                                                                                                                                                                                                  File size:216'576 bytes
                                                                                                                                                                                                                                                  MD5:7c77b3c5e87cd408d0565c369a4d9e2f
                                                                                                                                                                                                                                                  SHA1:071767bbb20bc1a134c983e9259b1734973faf87
                                                                                                                                                                                                                                                  SHA256:970dd08b78f4db8373c1f5965ebfa179174783ee2d31024c74219bcff97a4749
                                                                                                                                                                                                                                                  SHA512:d4a3edec4f5838f42a9206f69529fbb11ad699a3251c744f8213126288f2258730b998950b26af1455ea3ca5e76b80caad290274111d536b0016389b4bf6d24d
                                                                                                                                                                                                                                                  SSDEEP:3072:ap8Lc70UkL/JHt6hpkBzEhE0faKQAc7LGZPHb/5FVuBJ+U53TXbYwEKrFJ:dLTr5t6hpk8E0CfSb1gpEKr
                                                                                                                                                                                                                                                  TLSH:9C244A5873F80A59F6BF6FB9A8F101108BB0F857A926D74E0D8561DD1EB2784D840BB3
                                                                                                                                                                                                                                                  File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U............"...0..D...........b... ........@.. ....................................`................................
                                                                                                                                                                                                                                                  Icon Hash:90cececece8e8eb0
                                                                                                                                                                                                                                                  Entrypoint:0x43621e
                                                                                                                                                                                                                                                  Entrypoint Section:.text
                                                                                                                                                                                                                                                  Digitally signed:false
                                                                                                                                                                                                                                                  Imagebase:0x400000
                                                                                                                                                                                                                                                  Subsystem:windows gui
                                                                                                                                                                                                                                                  Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                                                                                                                                                                                                                                  DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                                                  Time Stamp:0xFC8F558F [Thu Apr 10 06:26:23 2104 UTC]
                                                                                                                                                                                                                                                  TLS Callbacks:
                                                                                                                                                                                                                                                  CLR (.Net) Version:
                                                                                                                                                                                                                                                  OS Version Major:4
                                                                                                                                                                                                                                                  OS Version Minor:0
                                                                                                                                                                                                                                                  File Version Major:4
                                                                                                                                                                                                                                                  File Version Minor:0
                                                                                                                                                                                                                                                  Subsystem Version Major:4
                                                                                                                                                                                                                                                  Subsystem Version Minor:0
                                                                                                                                                                                                                                                  Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744
                                                                                                                                                                                                                                                  Instruction
                                                                                                                                                                                                                                                  jmp dword ptr [00402000h]
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                                                                                                                  NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_IMPORT0x361cc0x4f.text
                                                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_RESOURCE0x380000x5ac.rsrc
                                                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_BASERELOC0x3a0000xc.reloc
                                                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_DEBUG0x361b00x1c.text
                                                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
                                                                                                                                                                                                                                                  NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                                                  .text0x20000x342240x344008095283af89bef33cfba63a05f768ee0False0.43482263008373206data5.956812705424224IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                  .rsrc0x380000x5ac0x600aa4d32f077ce322aee3ae18708136e2dFalse0.416015625data4.0750387696154515IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                  .reloc0x3a0000xc0x20000ce2bd99fdcfbf14dd34b175a68b0c3False0.044921875data0.10191042566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                  NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                                                  RT_VERSION0x380900x31cdata0.4258793969849246
                                                                                                                                                                                                                                                  RT_MANIFEST0x383bc0x1eaXML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators0.5489795918367347
                                                                                                                                                                                                                                                  DLLImport
                                                                                                                                                                                                                                                  mscoree.dll_CorExeMain
                                                                                                                                                                                                                                                  DescriptionData
                                                                                                                                                                                                                                                  Translation0x0000 0x04b0
                                                                                                                                                                                                                                                  Comments
                                                                                                                                                                                                                                                  CompanyName
                                                                                                                                                                                                                                                  FileDescriptionZeroTrace
                                                                                                                                                                                                                                                  FileVersion1.0.0.0
                                                                                                                                                                                                                                                  InternalNameZeroTrace.exe
                                                                                                                                                                                                                                                  LegalCopyrightCopyright 2024
                                                                                                                                                                                                                                                  LegalTrademarks
                                                                                                                                                                                                                                                  OriginalFilenameZeroTrace.exe
                                                                                                                                                                                                                                                  ProductNameZeroTrace
                                                                                                                                                                                                                                                  ProductVersion1.0.0.0
                                                                                                                                                                                                                                                  Assembly Version1.0.0.0
                                                                                                                                                                                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:06.141841888 CET49681443192.168.2.734.117.59.81
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:06.141887903 CET4434968134.117.59.81192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:06.141963005 CET49681443192.168.2.734.117.59.81
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:06.153923035 CET49681443192.168.2.734.117.59.81
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:06.153934956 CET4434968134.117.59.81192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:06.633616924 CET4434968134.117.59.81192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:06.633697987 CET49681443192.168.2.734.117.59.81
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:06.639281034 CET49681443192.168.2.734.117.59.81
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:06.639297009 CET4434968134.117.59.81192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:06.639590979 CET4434968134.117.59.81192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:06.686906099 CET49681443192.168.2.734.117.59.81
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:06.705132008 CET49681443192.168.2.734.117.59.81
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:06.752331972 CET4434968134.117.59.81192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:06.834861040 CET4434968134.117.59.81192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:06.834940910 CET4434968134.117.59.81192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:06.835000992 CET49681443192.168.2.734.117.59.81
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:06.845141888 CET49681443192.168.2.734.117.59.81
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:14.516194105 CET49682443192.168.2.7104.26.0.100
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:14.516258955 CET44349682104.26.0.100192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:14.516366005 CET49682443192.168.2.7104.26.0.100
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:14.516927004 CET49682443192.168.2.7104.26.0.100
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:14.516961098 CET44349682104.26.0.100192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:14.996336937 CET44349682104.26.0.100192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:14.996432066 CET49682443192.168.2.7104.26.0.100
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:14.999660015 CET49682443192.168.2.7104.26.0.100
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:14.999670982 CET44349682104.26.0.100192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:14.999955893 CET44349682104.26.0.100192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:15.001405954 CET49682443192.168.2.7104.26.0.100
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:15.044334888 CET44349682104.26.0.100192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:15.151643038 CET44349682104.26.0.100192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:15.152503014 CET44349682104.26.0.100192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:15.152565956 CET49682443192.168.2.7104.26.0.100
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:15.153023958 CET49682443192.168.2.7104.26.0.100
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:18.420479059 CET49690443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:18.420510054 CET44349690172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:18.420591116 CET49690443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:18.420945883 CET49690443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:18.420960903 CET44349690172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:18.991787910 CET49690443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:18.992872000 CET49693443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:18.992881060 CET44349693172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:18.992927074 CET49693443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:18.994515896 CET49693443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:18.994529963 CET44349693172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:19.036322117 CET44349690172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:19.273240089 CET44349690172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:19.273432016 CET44349690172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:19.273511887 CET49690443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:19.273536921 CET49690443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:19.498800993 CET49695443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:19.498847961 CET44349695172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:19.498934031 CET49695443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:19.499247074 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:19.499253988 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:19.499351025 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:19.501149893 CET49695443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:19.501159906 CET44349695172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:19.501440048 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:19.501450062 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:19.821643114 CET44349693172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:19.829441071 CET49693443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:19.829471111 CET44349693172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:19.830414057 CET44349693172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:19.830476046 CET49693443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:19.832242012 CET49693443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:19.832303047 CET44349693172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:19.832756996 CET49697443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:19.832808971 CET44349697172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:19.832873106 CET49697443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:19.832978010 CET49693443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:19.832986116 CET44349693172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:19.833463907 CET49697443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:19.833481073 CET44349697172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:19.874475002 CET49693443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.128317118 CET44349693172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.128360033 CET44349693172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.128391027 CET44349693172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.128403902 CET49693443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.128422976 CET44349693172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.128462076 CET49693443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.128467083 CET44349693172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.128480911 CET44349693172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.128525972 CET49693443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.128532887 CET44349693172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.131513119 CET44349693172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.131566048 CET49693443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.155797958 CET49693443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.155814886 CET44349693172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.337694883 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.338504076 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.338536978 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.339536905 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.339612961 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.340229988 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.340287924 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.340424061 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.340430975 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.348392963 CET44349695172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.348620892 CET49695443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.348637104 CET44349695172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.349682093 CET44349695172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.349757910 CET49695443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.350228071 CET49695443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.350292921 CET44349695172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.350503922 CET49695443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.350512028 CET44349695172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.384176016 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.491480112 CET49695443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.649234056 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.649286032 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.649318933 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.649331093 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.649358034 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.649394989 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.649395943 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.649408102 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.649451971 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.649880886 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.649924994 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.649960041 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.649966002 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.651448965 CET44349695172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.651762962 CET44349695172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.651808023 CET49695443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.653781891 CET49695443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.653800964 CET44349695172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.654470921 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.654556990 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.654563904 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.669642925 CET44349697172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.669919014 CET49697443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.669948101 CET44349697172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.670296907 CET44349697172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.670785904 CET49697443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.670845985 CET44349697172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.719358921 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.719424009 CET49697443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.735524893 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.738569021 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.738593102 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.738636971 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.738660097 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.738696098 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.744916916 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.751188993 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.751230955 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.751254082 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.757556915 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.757603884 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.757616043 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.763844013 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.763869047 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.763900042 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.763910055 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.764125109 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.770106077 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.776382923 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.776406050 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.776463032 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.776473999 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.778069019 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.782846928 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.788990974 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.789048910 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.789058924 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.824135065 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.824177980 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.824204922 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.824243069 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.824280024 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.824311018 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.824347019 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.824448109 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.826941967 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.831444979 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.831495047 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.831526041 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.831533909 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.837014914 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.838265896 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.844089985 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.844132900 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.844161987 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.844168901 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.847111940 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.850404024 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.856740952 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.856811047 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.856843948 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.856852055 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.857079029 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.863109112 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.869204044 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.869257927 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.869287968 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.869306087 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.869570017 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.874911070 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.880192041 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.880224943 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.880250931 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.880264997 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.880460024 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.885487080 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.890518904 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.890577078 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.890608072 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.890635014 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.890748978 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.895095110 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.899780989 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.899828911 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.899852991 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.899872065 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.900054932 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.904465914 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.909056902 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.909164906 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.909185886 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.909199953 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.909333944 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.913777113 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.918359995 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.918396950 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.918425083 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.918453932 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.918823957 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.921281099 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.923908949 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.923978090 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.923981905 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.923994064 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.924272060 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.926666021 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.929445982 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.929476976 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.929516077 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.929541111 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.929706097 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.932157993 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.932214975 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.934006929 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.934030056 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.934849977 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.934953928 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.934962034 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.937567949 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.937907934 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.937922955 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.940332890 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.941721916 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.941731930 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.943044901 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.943106890 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.943114996 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.945914984 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.946016073 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.946024895 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.948477030 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.948697090 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.948712111 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.951527119 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.952033043 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.952054977 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.957588911 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.957643986 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.957670927 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.957695961 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.958038092 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.958110094 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.961694956 CET49696443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.961723089 CET44349696172.217.16.196192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.748689890 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.753616095 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.753829956 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.781397104 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.781491995 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.781514883 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.781547070 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.786253929 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.786271095 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.786279917 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.786288977 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.786313057 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.786322117 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.786330938 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.786350012 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.786354065 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.786354065 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.786359072 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.786366940 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.786375999 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.786376953 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.786387920 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.786395073 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.786405087 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.786436081 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.786436081 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.786458969 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.786572933 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.791213036 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.791228056 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.791239023 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.791250944 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.791266918 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.791295052 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.791323900 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.832272053 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.832432032 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.880281925 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.880368948 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.928244114 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.928566933 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.976284027 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:21.976428986 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.028269053 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.110171080 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.110363007 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.115206957 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.115221977 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.115238905 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.115247965 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.115293026 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.115328074 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.115359068 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.115367889 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.115408897 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.115410089 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.115418911 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.115462065 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.115469933 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.115518093 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.115582943 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.115621090 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.115688086 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.115711927 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.115767956 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.115891933 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.115900040 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.115907907 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.115933895 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.116015911 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.116065979 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.116074085 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.116111994 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.116183996 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.116214991 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.116265059 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.116327047 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.120080948 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.120110035 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.120150089 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.120223045 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.120273113 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.120326042 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.123945951 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.123989105 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.123989105 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.124031067 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.124066114 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.124088049 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.124120951 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.124150991 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.124181986 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.124212980 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.124239922 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.124274969 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.124314070 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.124337912 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.128243923 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.128283024 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.128323078 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.128355980 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.128388882 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.128418922 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.128454924 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.128488064 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.128515959 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.128547907 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.128748894 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.128798962 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.128855944 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.128897905 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.128916979 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.128926039 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.128967047 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129163027 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129170895 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129199982 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129205942 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129215002 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129216909 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129247904 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129276037 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129283905 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129287958 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129331112 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129396915 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129404068 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129411936 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129545927 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129554033 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129561901 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129579067 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129585981 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129592896 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129652977 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129662991 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129673004 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129688978 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129695892 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129751921 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129759073 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129766941 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129807949 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129817009 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129825115 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129839897 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129847050 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129898071 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129904985 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129913092 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129957914 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.129966021 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.132560015 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.132656097 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.132656097 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.132693052 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.132726908 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.132760048 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.132796049 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.132822037 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.132852077 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.132960081 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.132975101 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.133059025 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.133126974 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.133136988 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.133153915 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.133162022 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.133177996 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.133186102 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.133194923 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.133210897 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.133218050 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.133225918 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.133271933 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.133280039 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.133332014 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.133341074 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.133348942 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.133433104 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.133451939 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.133528948 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.133537054 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.133544922 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.133594036 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.133603096 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.133610964 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.133629084 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.133636951 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.133644104 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.133683920 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.133692980 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.133766890 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.133776903 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.133785009 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.133856058 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.133865118 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.133872986 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.134033918 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.134042978 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.134175062 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.134182930 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.134191036 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.134284019 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.134293079 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.134295940 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.134304047 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.134310961 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.134347916 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.134355068 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.134362936 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.134370089 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.134378910 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.134392023 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.134407043 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.137456894 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.137465954 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.137569904 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.137578011 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.137586117 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.137588978 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.137597084 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.137614012 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.137623072 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.137635946 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.137706995 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.137715101 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.137722969 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.137770891 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.137778997 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.137842894 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.137851000 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.137861013 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.137912035 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.137919903 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.137976885 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.137984991 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.137995005 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.138045073 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.138124943 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.138133049 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.138178110 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.138187885 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.138195038 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.138211966 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.138221979 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.138330936 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.138339043 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.138345957 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.138350010 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.138358116 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.141232967 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.141280890 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.141299963 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.141328096 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.141355991 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.141392946 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.141416073 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.141441107 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.141468048 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.141496897 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.145097017 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.145145893 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.145173073 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.145200968 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.145235062 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.145256042 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.145282030 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.145312071 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.145347118 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.145369053 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.145401955 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.145426035 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.145458937 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.145479918 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.145507097 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.145534039 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.145560980 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.145593882 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.145625114 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.145946980 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.145956993 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146001101 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146008015 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146015882 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146059990 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146068096 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146079063 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146122932 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146131039 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146148920 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146157026 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146164894 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146200895 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146209955 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146226883 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146234989 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146243095 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146292925 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146301031 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146310091 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146327972 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146336079 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146344900 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146352053 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146359921 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146425962 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146433115 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146436930 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146439075 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146471024 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146480083 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146488905 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146503925 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146512032 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146518946 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146527052 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146542072 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146550894 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.146553993 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.149625063 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.149796009 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.149805069 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.149836063 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.149836063 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.149848938 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.149856091 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.149856091 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.149857998 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.149866104 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.149902105 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.149909973 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.149918079 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.149960995 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.149969101 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150012970 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150021076 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150024891 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150041103 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150068045 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150075912 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150120020 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150136948 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150146961 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150156021 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150163889 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150223017 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150230885 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150238991 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150279045 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150286913 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150337934 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150346041 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150353909 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150398016 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150405884 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150413990 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150424004 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150439978 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150489092 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150496006 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150504112 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150520086 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150527954 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150536060 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150580883 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150588989 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150624990 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150635004 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150643110 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150670052 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150677919 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150685072 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150727987 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150737047 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150752068 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150759935 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150768042 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150806904 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150814056 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150821924 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150831938 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150866032 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150928020 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150934935 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.150943041 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.151036978 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.151046038 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.151052952 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.151061058 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.151070118 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.151087046 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.151093960 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.151102066 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.151165962 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.151175022 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.151181936 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.151190042 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.151197910 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.151215076 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.151222944 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.154294014 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.154334068 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.154335022 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.154344082 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.154351950 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.154354095 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.154360056 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.154416084 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.154442072 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.154468060 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.154473066 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.154494047 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.154531956 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.154555082 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.154582024 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.154586077 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.154593945 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.154613972 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.154635906 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.154644012 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.154650927 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.154659033 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.154695988 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.154704094 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.154709101 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.154771090 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.154779911 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.154787064 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.154839993 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.154846907 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.154906988 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.154915094 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.158353090 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.158389091 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.158422947 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.158461094 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.158494949 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.158529997 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.158567905 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.158591032 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.158623934 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159029961 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159039021 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159099102 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159106970 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159116030 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159162998 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159171104 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159178972 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159198999 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159205914 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159240007 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159246922 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159277916 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159349918 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159357071 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159359932 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159395933 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159404039 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159449100 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159456015 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159462929 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159502983 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159511089 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159518957 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159533978 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159542084 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159600019 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159606934 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159615040 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159630060 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159634113 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159636974 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159681082 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159687996 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159697056 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159706116 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159713030 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159774065 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159781933 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159789085 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159805059 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159811974 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159846067 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159898996 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159907103 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159960032 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159967899 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.159975052 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.162410975 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.162476063 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.162501097 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.162523985 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.162556887 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.162585974 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.162621975 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.162650108 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.162672997 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.162703037 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.162738085 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.162758112 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.162786007 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.162811041 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.162846088 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.162864923 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.162890911 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.162919044 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.162950039 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.163018942 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.163027048 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.163060904 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.163068056 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.163075924 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.163091898 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.163100004 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.163105965 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.163110971 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.163220882 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.163228035 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.163234949 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.163248062 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.163264036 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.163325071 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.163331985 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.163338900 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.163424015 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.163430929 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.163439035 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.163450003 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.163465023 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.163471937 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.163475990 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.163479090 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.163486958 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.163496017 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.163502932 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.163547039 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.163553953 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.163577080 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.163584948 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.163592100 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.163623095 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.163630962 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.163638115 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.166949987 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.166987896 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167028904 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167051077 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167098999 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167107105 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167114973 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167121887 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167151928 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167176962 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167208910 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167233944 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167244911 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167246103 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167252064 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167284012 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167284012 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167320013 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167336941 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167346001 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167387009 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167395115 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167452097 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167462111 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167469978 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167505026 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167514086 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167521000 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167527914 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167546034 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167608976 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167618036 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167627096 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167665005 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167673111 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167680025 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167749882 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167757988 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167789936 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167798042 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167804956 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167854071 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167860985 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167889118 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167905092 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167912006 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167967081 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167974949 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.167982101 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168025970 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168034077 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168040991 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168056965 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168066025 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168086052 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168093920 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168097019 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168133020 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168142080 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168148994 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168159008 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168174028 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168236017 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168243885 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168251991 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168273926 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168282986 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168291092 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168364048 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168371916 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168406963 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168411016 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168417931 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168421984 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168425083 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168427944 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168438911 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168442011 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168445110 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168447971 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168451071 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168489933 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168498039 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168500900 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168529987 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168538094 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.168545961 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.171394110 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.171427965 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.171447992 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.171473026 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.171504021 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.171650887 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.171658993 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.171662092 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.171744108 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.171751022 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.171760082 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.171775103 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.171782970 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.171789885 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.171847105 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.171854973 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.171915054 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.171922922 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.171930075 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.171972990 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.171981096 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.171988010 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.172003031 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.172009945 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.172081947 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.172090054 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.172096968 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.172106981 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.172113895 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.172121048 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.172137022 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.172144890 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.172162056 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.172169924 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.172177076 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.172231913 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.172240019 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.172246933 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.172257900 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.172265053 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.172280073 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.172286987 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.172293901 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.172350883 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.172358990 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.172368050 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.172383070 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.172389984 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.172398090 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.175658941 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.176088095 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.176095963 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.176125050 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.176132917 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.176146030 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.176188946 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.176197052 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.176254988 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.176261902 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.176270008 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.176285028 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.176291943 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.176295042 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.176347971 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.176354885 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.176453114 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.176460981 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.176467896 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.176479101 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.230849981 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.354346037 CET90004969923.94.126.116192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:22.354427099 CET496999000192.168.2.723.94.126.116
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:25.434798956 CET49697443192.168.2.7172.217.16.196
                                                                                                                                                                                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:06.130333900 CET5528753192.168.2.71.1.1.1
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:06.136832952 CET53552871.1.1.1192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:07.163137913 CET5357953192.168.2.71.1.1.1
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:07.171334028 CET53535791.1.1.1192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:14.508843899 CET5290453192.168.2.71.1.1.1
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:14.515455008 CET53529041.1.1.1192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:18.119106054 CET53494591.1.1.1192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:18.297167063 CET53652581.1.1.1192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:18.403861046 CET5083353192.168.2.71.1.1.1
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:18.404264927 CET5909553192.168.2.71.1.1.1
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:18.410593033 CET53508331.1.1.1192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:18.410824060 CET53590951.1.1.1192.168.2.7
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:20.231173038 CET53563001.1.1.1192.168.2.7
                                                                                                                                                                                                                                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:06.130333900 CET192.168.2.71.1.1.10xfecdStandard query (0)ipinfo.ioA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:07.163137913 CET192.168.2.71.1.1.10x640dStandard query (0)144.48.8.0.in-addr.arpaPTR (Pointer record)IN (0x0001)false
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:14.508843899 CET192.168.2.71.1.1.10xa036Standard query (0)get.geojs.ioA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:18.403861046 CET192.168.2.71.1.1.10x3ab5Standard query (0)www.google.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:18.404264927 CET192.168.2.71.1.1.10x5e9bStandard query (0)www.google.com65IN (0x0001)false
                                                                                                                                                                                                                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:06.136832952 CET1.1.1.1192.168.2.70xfecdNo error (0)ipinfo.io34.117.59.81A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:07.171334028 CET1.1.1.1192.168.2.70x640dName error (3)144.48.8.0.in-addr.arpanonenonePTR (Pointer record)IN (0x0001)false
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:14.515455008 CET1.1.1.1192.168.2.70xa036No error (0)get.geojs.io104.26.0.100A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:14.515455008 CET1.1.1.1192.168.2.70xa036No error (0)get.geojs.io172.67.70.233A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:14.515455008 CET1.1.1.1192.168.2.70xa036No error (0)get.geojs.io104.26.1.100A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:18.410593033 CET1.1.1.1192.168.2.70x3ab5No error (0)www.google.com172.217.16.196A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                  Mar 15, 2025 14:35:18.410824060 CET1.1.1.1192.168.2.70x5e9bNo error (0)www.google.com65IN (0x0001)false
                                                                                                                                                                                                                                                  • ipinfo.io
                                                                                                                                                                                                                                                  • get.geojs.io
                                                                                                                                                                                                                                                  • www.google.com
                                                                                                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                  0192.168.2.74968134.117.59.814436924C:\Users\user\Desktop\Build.exe
                                                                                                                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                  2025-03-15 13:35:06 UTC59OUTGET / HTTP/1.1
                                                                                                                                                                                                                                                  Host: ipinfo.io
                                                                                                                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                                                                                                                  2025-03-15 13:35:06 UTC457INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                  access-control-allow-origin: *
                                                                                                                                                                                                                                                  Content-Length: 321
                                                                                                                                                                                                                                                  content-type: application/json; charset=utf-8
                                                                                                                                                                                                                                                  date: Sat, 15 Mar 2025 13:35:06 GMT
                                                                                                                                                                                                                                                  referrer-policy: strict-origin-when-cross-origin
                                                                                                                                                                                                                                                  x-content-type-options: nosniff
                                                                                                                                                                                                                                                  x-frame-options: SAMEORIGIN
                                                                                                                                                                                                                                                  x-xss-protection: 1; mode=block
                                                                                                                                                                                                                                                  via: 1.1 google
                                                                                                                                                                                                                                                  strict-transport-security: max-age=2592000; includeSubDomains
                                                                                                                                                                                                                                                  Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                                                                                                                                                                  Connection: close
                                                                                                                                                                                                                                                  2025-03-15 13:35:06 UTC321INData Raw: 7b 0a 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 0a 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 38 39 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 22 2c 0a 20 20 22 70 6f 73 74 61 6c 22 3a 20 22 31 30 30 30 31 22 2c 0a 20 20 22 74 69 6d 65 7a 6f 6e 65 22 3a
                                                                                                                                                                                                                                                  Data Ascii: { "ip": "8.46.123.189", "hostname": "static-cpe-8-46-123-189.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Level 3 Parent, LLC", "postal": "10001", "timezone":


                                                                                                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                  1192.168.2.749682104.26.0.1004436924C:\Users\user\Desktop\Build.exe
                                                                                                                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                  2025-03-15 13:35:14 UTC76OUTGET /v1/ip/geo.json HTTP/1.1
                                                                                                                                                                                                                                                  Host: get.geojs.io
                                                                                                                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                                                                                                                  2025-03-15 13:35:15 UTC1130INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                  Date: Sat, 15 Mar 2025 13:35:15 GMT
                                                                                                                                                                                                                                                  Content-Type: application/json
                                                                                                                                                                                                                                                  Transfer-Encoding: chunked
                                                                                                                                                                                                                                                  Connection: close
                                                                                                                                                                                                                                                  x-request-id: 60f467d34ec752bf9f903d371e1a76f1-ASH
                                                                                                                                                                                                                                                  strict-transport-security: max-age=15552000; includeSubDomains; preload
                                                                                                                                                                                                                                                  access-control-allow-origin: *
                                                                                                                                                                                                                                                  access-control-allow-methods: GET
                                                                                                                                                                                                                                                  pragma: no-cache
                                                                                                                                                                                                                                                  Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
                                                                                                                                                                                                                                                  geojs-backend: ash-01
                                                                                                                                                                                                                                                  cf-cache-status: DYNAMIC
                                                                                                                                                                                                                                                  Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c0aopenFcCxsVuwO2yIKOTo8O87nwn%2BPkQ%2BkbXN0zK%2BJSxcy7RDYCGL%2F2qgH0zkN6ez8i7SUySKUQcKVm4DA7dtl%2BzeWPBV%2FbHatda%2BBsaKbGFyYq3oNZ7hlRtT23A%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                  NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                  X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                                  Server: cloudflare
                                                                                                                                                                                                                                                  CF-RAY: 920c64972ea26e53-EWR
                                                                                                                                                                                                                                                  alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                  server-timing: cfL4;desc="?proto=TCP&rtt=2407&min_rtt=2386&rtt_var=938&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2813&recv_bytes=690&delivery_rate=1140625&cwnd=123&unsent_bytes=0&cid=181251fdaa3288b3&ts=159&x=0"
                                                                                                                                                                                                                                                  2025-03-15 13:35:15 UTC239INData Raw: 31 34 36 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 22 61 72 65 61 5f 63 6f 64 65 22 3a 22 30 22 2c 22 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 5f 6e 61 6d 65 22 3a 22 4c 45 56 45 4c 33 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 33 22 3a 22 55 53 41 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 5f 63 6f 64 65 22 3a 22 4e 41 22 2c 22 61 73 6e 22 3a 33 33 35 36 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 22 34 30 2e 37 31 32 36 22 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 22 2d 37 34 2e 30 30 36 36 22 2c 22 61 63 63 75 72 61 63 79 22 3a 32 30 2c 22 72 65 67 69 6f 6e 22 3a
                                                                                                                                                                                                                                                  Data Ascii: 146{"ip":"8.46.123.189","area_code":"0","organization_name":"LEVEL3","country_code":"US","country_code3":"USA","continent_code":"NA","asn":3356,"country":"United States","latitude":"40.7126","longitude":"-74.0066","accuracy":20,"region":
                                                                                                                                                                                                                                                  2025-03-15 13:35:15 UTC94INData Raw: 22 4e 65 77 20 59 6f 72 6b 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 5c 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 22 41 53 33 33 35 36 20 4c 45 56 45 4c 33 22 7d 0a 0d 0a
                                                                                                                                                                                                                                                  Data Ascii: "New York","timezone":"America\/New_York","city":"New York","organization":"AS3356 LEVEL3"}
                                                                                                                                                                                                                                                  2025-03-15 13:35:15 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                  Data Ascii: 0


                                                                                                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                  2192.168.2.749693172.217.16.1964435792C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                  2025-03-15 13:35:19 UTC589OUTGET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1
                                                                                                                                                                                                                                                  Host: www.google.com
                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                  X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiKo8sBCIWgzQEI9s/OAQiA1s4BCMnczgEIhODOAQii5M4BCK/kzgEI6eTOAQ==
                                                                                                                                                                                                                                                  Sec-Fetch-Site: none
                                                                                                                                                                                                                                                  Sec-Fetch-Mode: no-cors
                                                                                                                                                                                                                                                  Sec-Fetch-Dest: empty
                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate, br, zstd
                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.9
                                                                                                                                                                                                                                                  2025-03-15 13:35:20 UTC1303INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                  Date: Sat, 15 Mar 2025 13:35:20 GMT
                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                  Expires: -1
                                                                                                                                                                                                                                                  Cache-Control: no-cache, must-revalidate
                                                                                                                                                                                                                                                  Content-Type: text/javascript; charset=UTF-8
                                                                                                                                                                                                                                                  Strict-Transport-Security: max-age=31536000
                                                                                                                                                                                                                                                  Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-QZrIV9Rwgka8wGJYYDjFAw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1
                                                                                                                                                                                                                                                  Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws"
                                                                                                                                                                                                                                                  Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]}
                                                                                                                                                                                                                                                  Accept-CH: Sec-CH-Prefers-Color-Scheme
                                                                                                                                                                                                                                                  Accept-CH: Downlink
                                                                                                                                                                                                                                                  Accept-CH: RTT
                                                                                                                                                                                                                                                  Accept-CH: Sec-CH-UA-Form-Factors
                                                                                                                                                                                                                                                  Accept-CH: Sec-CH-UA-Platform
                                                                                                                                                                                                                                                  Accept-CH: Sec-CH-UA-Platform-Version
                                                                                                                                                                                                                                                  Accept-CH: Sec-CH-UA-Full-Version
                                                                                                                                                                                                                                                  Accept-CH: Sec-CH-UA-Arch
                                                                                                                                                                                                                                                  Accept-CH: Sec-CH-UA-Model
                                                                                                                                                                                                                                                  Accept-CH: Sec-CH-UA-Bitness
                                                                                                                                                                                                                                                  Accept-CH: Sec-CH-UA-Full-Version-List
                                                                                                                                                                                                                                                  Accept-CH: Sec-CH-UA-WoW64
                                                                                                                                                                                                                                                  Permissions-Policy: unload=()
                                                                                                                                                                                                                                                  Content-Disposition: attachment; filename="f.txt"
                                                                                                                                                                                                                                                  Server: gws
                                                                                                                                                                                                                                                  X-XSS-Protection: 0
                                                                                                                                                                                                                                                  X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                                  Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                                                                                                                                                                  Accept-Ranges: none
                                                                                                                                                                                                                                                  Vary: Accept-Encoding
                                                                                                                                                                                                                                                  Connection: close
                                                                                                                                                                                                                                                  Transfer-Encoding: chunked
                                                                                                                                                                                                                                                  2025-03-15 13:35:20 UTC87INData Raw: 31 37 39 33 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 74 6f 72 6f 6e 74 6f 20 6d 61 70 6c 65 20 6c 65 61 66 73 22 2c 22 6e 79 74 20 73 74 72 61 6e 64 73 20 68 69 6e 74 73 20 6d 61 72 63 68 20 31 35 22 2c 22 6d 6f 6e 73 74 65 72 20 68 75 6e 74 65 72 20 77 69 6c 64
                                                                                                                                                                                                                                                  Data Ascii: 1793)]}'["",["toronto maple leafs","nyt strands hints march 15","monster hunter wild
                                                                                                                                                                                                                                                  2025-03-15 13:35:20 UTC1390INData Raw: 73 22 2c 22 61 6e 74 61 72 63 74 69 63 61 20 6d 61 70 22 2c 22 6a 6f 61 6e 6e 20 67 69 66 74 20 63 61 72 64 73 22 2c 22 6e 65 77 20 6d 6f 76 69 65 73 20 73 74 72 65 61 6d 69 6e 67 22 2c 22 6f 6c 65 20 6d 69 73 73 20 77 79 61 74 74 20 74 68 69 73 74 6c 65 20 64 65 61 74 68 22 2c 22 67 65 6e 73 68 69 6e 20 69 6d 70 61 63 74 20 35 2e 35 20 6c 69 76 65 73 74 72 65 61 6d 20 63 6f 64 65 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 6f 49 6b 6b 34 53 46 51 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32
                                                                                                                                                                                                                                                  Data Ascii: s","antarctica map","joann gift cards","new movies streaming","ole miss wyatt thistle death","genshin impact 5.5 livestream codes"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChoIkk4SFQoRVHJlbmRpbmcgc2
                                                                                                                                                                                                                                                  2025-03-15 13:35:20 UTC1390INData Raw: 76 56 45 67 72 4e 69 74 4f 52 58 6c 54 4c 30 70 55 65 6e 6c 50 57 6c 68 70 62 6d 51 78 57 6c 5a 58 59 6e 46 32 62 32 30 32 64 6c 4a 57 4f 47 4a 34 4d 47 31 59 52 54 5a 43 61 6a 52 56 61 32 5a 4a 55 45 46 36 61 6a 64 6e 5a 47 70 72 59 56 4a 4f 64 6d 6f 34 59 58 46 6f 5a 56 56 4e 4e 6c 42 4c 63 58 56 33 54 31 64 56 61 32 70 75 4c 7a 4d 7a 4e 32 51 35 52 53 74 75 4e 32 70 6a 63 6b 4a 6c 4e 56 5a 30 55 79 39 48 63 58 64 4e 59 7a 46 50 5a 7a 68 53 53 32 31 4d 4d 6b 6c 59 55 47 39 6c 4e 44 64 6d 4f 47 63 72 59 55 63 77 4d 31 4e 4c 63 58 42 4c 4d 6a 4d 77 61 46 64 44 62 32 78 49 64 33 64 6c 5a 56 42 36 53 32 52 34 51 57 4a 4b 4e 45 4a 44 54 6e 6c 33 51 55 38 77 4b 7a 4a 79 53 57 38 34 55 55 78 69 4d 54 64 4c 56 6a 63 34 61 45 4a 79 59 55 68 59 51 58 6c 48 63 6d
                                                                                                                                                                                                                                                  Data Ascii: vVEgrNitORXlTL0pUenlPWlhpbmQxWlZXYnF2b202dlJWOGJ4MG1YRTZCajRVa2ZJUEF6ajdnZGprYVJOdmo4YXFoZVVNNlBLcXV3T1dVa2puLzMzN2Q5RStuN2pjckJlNVZ0Uy9HcXdNYzFPZzhSS21MMklYUG9lNDdmOGcrYUcwM1NLcXBLMjMwaFdDb2xId3dlZVB6S2R4QWJKNEJDTnl3QU8wKzJySW84UUxiMTdLVjc4aEJyYUhYQXlHcm
                                                                                                                                                                                                                                                  2025-03-15 13:35:20 UTC1390INData Raw: 31 6b 77 51 55 74 68 51 32 52 58 65 6c 68 34 54 46 6c 5a 5a 57 30 32 56 56 4d 78 4d 44 4e 73 52 58 70 31 63 58 4a 42 55 46 5a 31 56 48 6c 6d 57 56 6c 51 4d 7a 64 5a 53 6e 5a 56 4d 48 4e 48 61 6d 45 35 52 56 64 4c 56 6d 46 4c 4b 7a 45 7a 4d 6e 70 59 56 33 46 78 53 6d 31 79 62 47 31 77 62 6c 42 71 57 45 4e 74 4f 46 46 6e 54 54 4e 43 4c 33 4d 30 4e 54 67 79 52 48 70 35 59 7a 6b 35 57 54 42 79 4e 55 70 57 4f 45 46 59 51 7a 68 36 64 33 68 69 4e 57 31 4c 55 30 68 69 53 48 56 35 53 45 39 36 53 69 74 69 5a 58 64 4d 57 6b 68 36 62 6b 6c 50 55 30 52 5a 4e 6a 64 58 62 57 68 32 54 6b 31 30 54 6d 4d 30 51 6c 42 42 53 45 51 72 52 33 70 46 51 57 74 6b 63 7a 52 51 55 44 52 50 63 30 31 30 5a 33 52 71 56 32 46 77 64 45 31 47 53 6b 52 55 56 57 78 53 52 54 42 69 63 46 52 34
                                                                                                                                                                                                                                                  Data Ascii: 1kwQUthQ2RXelh4TFlZZW02VVMxMDNsRXp1cXJBUFZ1VHlmWVlQMzdZSnZVMHNHamE5RVdLVmFLKzEzMnpYV3FxSm1ybG1wblBqWENtOFFnTTNCL3M0NTgyRHp5Yzk5WTByNUpWOEFYQzh6d3hiNW1LU0hiSHV5SE96SitiZXdMWkh6bklPU0RZNjdXbWh2Tk10TmM0QlBBSEQrR3pFQWtkczRQUDRPc010Z3RqV2FwdE1GSkRUVWxSRTBicFR4
                                                                                                                                                                                                                                                  2025-03-15 13:35:20 UTC1390INData Raw: 51 55 31 42 64 30 56 42 51 57 68 46 52 45 56 52 51 53 39 42 54 7a 51 77 51 55 74 6e 51 6c 56 42 53 32 64 43 56 55 46 53 57 44 46 44 65 6c 4d 30 52 6e 55 35 4d 55 4e 7a 65 44 52 44 52 6e 68 75 54 6b 73 77 53 33 6c 73 4d 46 42 59 52 47 4e 59 52 6a 51 35 4c 32 4e 53 65 48 68 34 52 55 6c 6e 53 6a 4a 6f 63 30 55 31 59 6b 67 79 63 56 5a 4d 4d 6b 70 4e 64 6a 64 6c 4e 47 68 31 56 54 4d 79 4f 48 46 54 53 6d 35 48 56 6b 39 53 62 58 46 55 56 44 52 4c 53 48 6c 50 53 54 51 79 59 7a 6c 47 51 6b 35 4e 51 33 56 55 56 33 4a 6b 4d 6d 68 44 5a 32 35 34 57 6c 42 45 53 46 42 6d 51 53 39 5a 63 46 64 47 52 47 38 35 56 32 6c 72 56 30 35 72 55 57 74 54 55 32 4a 42 59 7a 6c 45 65 43 74 34 55 6c 6c 56 57 69 39 7a 64 30 35 31 4e 6b 5a 73 4d 30 74 36 59 33 4e 50 51 58 56 6a 4e 53 73
                                                                                                                                                                                                                                                  Data Ascii: QU1Bd0VBQWhFREVRQS9BTzQwQUtnQlVBS2dCVUFSWDFDelM0RnU5MUNzeDRDRnhuTkswS3lsMFBYRGNYRjQ5L2NSeHh4RUlnSjJoc0U1YkgycVZMMkpNdjdlNGh1VTMyOHFTSm5HVk9SbXFUVDRLSHlPSTQyYzlGQk5NQ3VUV3JkMmhDZ254WlBESFBmQS9ZcFdGRG85V2lrV05rUWtTU2JBYzlEeCt4UllVWi9zd051NkZsM0t6Y3NPQXVjNSs
                                                                                                                                                                                                                                                  2025-03-15 13:35:20 UTC396INData Raw: 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 65 76 65 6e 74 69 64 22 3a 22 36 35 39 37 33 30 39 39 37 34 34 30 39 35 39 38 31 39 38 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 31 32 35 31 2c 31 32 35 30 2c 31 30 35 31 2c 31 30 35 30 2c 36 30 31 2c 36 30 30 2c 35 35 31 2c 35 35 30 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 73 75 62 74 79 70 65 73 22 3a 5b 5b 33 2c 31 34 33 2c 33 36 32 2c 33 30 38 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 2c 33 30 38 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 2c 33 30 38 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 2c 33 30 38 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 2c 33 30 38 5d 2c
                                                                                                                                                                                                                                                  Data Ascii: "zl":10002},{"zl":10002},{"zl":10002}],"google:suggesteventid":"6597309974409598198","google:suggestrelevance":[1251,1250,1051,1050,601,600,551,550],"google:suggestsubtypes":[[3,143,362,308],[3,143,362,308],[3,143,362,308],[3,143,362,308],[3,143,362,308],
                                                                                                                                                                                                                                                  2025-03-15 13:35:20 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                  Data Ascii: 0


                                                                                                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                  3192.168.2.749696172.217.16.1964435792C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                  2025-03-15 13:35:20 UTC492OUTGET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1
                                                                                                                                                                                                                                                  Host: www.google.com
                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                  X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiKo8sBCIWgzQEI9s/OAQiA1s4BCMnczgEIhODOAQii5M4BCK/kzgEI6eTOAQ==
                                                                                                                                                                                                                                                  Sec-Fetch-Site: cross-site
                                                                                                                                                                                                                                                  Sec-Fetch-Mode: no-cors
                                                                                                                                                                                                                                                  Sec-Fetch-Dest: empty
                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate, br, zstd
                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.9
                                                                                                                                                                                                                                                  2025-03-15 13:35:20 UTC1055INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                  Version: 735763701
                                                                                                                                                                                                                                                  Content-Type: application/json; charset=UTF-8
                                                                                                                                                                                                                                                  X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                                  Strict-Transport-Security: max-age=31536000
                                                                                                                                                                                                                                                  Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws"
                                                                                                                                                                                                                                                  Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]}
                                                                                                                                                                                                                                                  Accept-CH: Sec-CH-Prefers-Color-Scheme
                                                                                                                                                                                                                                                  Accept-CH: Downlink
                                                                                                                                                                                                                                                  Accept-CH: RTT
                                                                                                                                                                                                                                                  Accept-CH: Sec-CH-UA-Form-Factors
                                                                                                                                                                                                                                                  Accept-CH: Sec-CH-UA-Platform
                                                                                                                                                                                                                                                  Accept-CH: Sec-CH-UA-Platform-Version
                                                                                                                                                                                                                                                  Accept-CH: Sec-CH-UA-Full-Version
                                                                                                                                                                                                                                                  Accept-CH: Sec-CH-UA-Arch
                                                                                                                                                                                                                                                  Accept-CH: Sec-CH-UA-Model
                                                                                                                                                                                                                                                  Accept-CH: Sec-CH-UA-Bitness
                                                                                                                                                                                                                                                  Accept-CH: Sec-CH-UA-Full-Version-List
                                                                                                                                                                                                                                                  Accept-CH: Sec-CH-UA-WoW64
                                                                                                                                                                                                                                                  Permissions-Policy: unload=()
                                                                                                                                                                                                                                                  Content-Disposition: attachment; filename="f.txt"
                                                                                                                                                                                                                                                  Date: Sat, 15 Mar 2025 13:35:20 GMT
                                                                                                                                                                                                                                                  Server: gws
                                                                                                                                                                                                                                                  X-XSS-Protection: 0
                                                                                                                                                                                                                                                  X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                                  Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                                                                                                                                                                  Accept-Ranges: none
                                                                                                                                                                                                                                                  Vary: Accept-Encoding
                                                                                                                                                                                                                                                  Connection: close
                                                                                                                                                                                                                                                  Transfer-Encoding: chunked
                                                                                                                                                                                                                                                  2025-03-15 13:35:20 UTC335INData Raw: 32 34 35 37 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 46 61 20 67 62 5f 32 64 20 67 62 5f 50 65 20 67 62 5f 72 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65
                                                                                                                                                                                                                                                  Data Ascii: 2457)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Fa gb_2d gb_Pe gb_rd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
                                                                                                                                                                                                                                                  2025-03-15 13:35:20 UTC1390INData Raw: 64 20 67 62 5f 70 64 20 67 62 5f 48 64 20 67 62 5f 6d 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 78 64 20 67 62 5f 73 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4b 63 20 67 62 5f 52 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30
                                                                                                                                                                                                                                                  Data Ascii: d gb_pd gb_Hd gb_md\"\u003e\u003cdiv class\u003d\"gb_xd gb_sd\"\u003e\u003cdiv class\u003d\"gb_Kc gb_R\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u0
                                                                                                                                                                                                                                                  2025-03-15 13:35:20 UTC1390INData Raw: 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 78 64 20 67 62 5f 39 63 20 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 62 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c
                                                                                                                                                                                                                                                  Data Ascii: e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_xd gb_9c gb_ad\"\u003e\u003cspan class\u003d\"gb_vd\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_bd\"\u003e \u003c\/div\u003e\u003c\/div\u003e\
                                                                                                                                                                                                                                                  2025-03-15 13:35:20 UTC1390INData Raw: 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76
                                                                                                                                                                                                                                                  Data Ascii: bindex\u003d\"0\"\u003e \u003csvg class\u003d\"gb_E\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v
                                                                                                                                                                                                                                                  2025-03-15 13:35:20 UTC1390INData Raw: 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20
                                                                                                                                                                                                                                                  Data Ascii: -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9
                                                                                                                                                                                                                                                  2025-03-15 13:35:20 UTC1390INData Raw: 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 36 35 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69
                                                                                                                                                                                                                                                  Data Ascii: -label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700265,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthi
                                                                                                                                                                                                                                                  2025-03-15 13:35:20 UTC1390INData Raw: 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 41 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 7a 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 42 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b
                                                                                                                                                                                                                                                  Data Ascii: a.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Ad\u003dfunction(a){return new _.zd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Bd\u003dglobalThis.trustedTypes;
                                                                                                                                                                                                                                                  2025-03-15 13:35:20 UTC636INData Raw: 65 77 20 5f 2e 4f 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 51 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4f 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 48 5c 22 29 3b 7d 3b 5f 2e 53 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 52 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 54 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 43 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 43 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 48 5c 22 29 3b
                                                                                                                                                                                                                                                  Data Ascii: ew _.Od(b?b.createScriptURL(a):a)};_.Qd\u003dfunction(a){if(a instanceof _.Od)return a.i;throw Error(\"H\");};_.Sd\u003dfunction(a){if(Rd.test(a))return a};_.Td\u003dfunction(a){if(a instanceof _.Cd)if(a instanceof _.Cd)a\u003da.i;else throw Error(\"H\");
                                                                                                                                                                                                                                                  2025-03-15 13:35:20 UTC488INData Raw: 31 65 31 0d 0a 64 28 5f 2e 42 63 28 61 2c 62 29 29 7d 3b 5f 2e 54 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 6c 65 74 20 64 3b 72 65 74 75 72 6e 28 64 5c 75 30 30 33 64 5f 2e 57 64 28 61 2c 62 29 29 21 5c 75 30 30 33 64 6e 75 6c 6c 3f 64 3a 63 7d 3b 5f 2e 58 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 6c 65 74 20 64 3b 72 65 74 75 72 6e 28 64 5c 75 30 30 33 64 5f 2e 53 28 61 2c 62 29 29 21 5c 75 30 30 33 64 6e 75 6c 6c 3f 64 3a 63 7d 3b 5f 2e 59 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 53 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33
                                                                                                                                                                                                                                                  Data Ascii: 1e1d(_.Bc(a,b))};_.T\u003dfunction(a,b,c\u003d0){let d;return(d\u003d_.Wd(a,b))!\u003dnull?d:c};_.Xd\u003dfunction(a,b,c\u003d0){let d;return(d\u003d_.S(a,b))!\u003dnull?d:c};_.Yd\u003dfunction(a){var b\u003d_.Sa(a);return b\u003d\u003d\"array\"||b\u003
                                                                                                                                                                                                                                                  2025-03-15 13:35:20 UTC1390INData Raw: 38 30 30 30 0d 0a 68 65 2c 24 64 3b 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 6e 65 77 20 24 64 28 5f 2e 61 65 28 61 29 29 3a 5a 64 7c 7c 28 5a 64 5c 75 30 30 33 64 6e 65 77 20 24 64 29 7d 3b 5f 2e 63 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 3f 61 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 62 29 3a 62 7d 3b 5f 2e 55 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 5c 75 30 30 33 64 62 7c 7c 64 6f 63 75 6d 65 6e 74 3b 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3f 61 5c 75 30 30 33 64 63 2e 67 65 74
                                                                                                                                                                                                                                                  Data Ascii: 8000he,$d;_.be\u003dfunction(a){return a?new $d(_.ae(a)):Zd||(Zd\u003dnew $d)};_.ce\u003dfunction(a,b){return typeof b\u003d\u003d\u003d\"string\"?a.getElementById(b):b};_.U\u003dfunction(a,b){var c\u003db||document;c.getElementsByClassName?a\u003dc.get


                                                                                                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                  4192.168.2.749695172.217.16.1964435792C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                  2025-03-15 13:35:20 UTC393OUTGET /async/newtab_promos HTTP/1.1
                                                                                                                                                                                                                                                  Host: www.google.com
                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                  Sec-Fetch-Site: cross-site
                                                                                                                                                                                                                                                  Sec-Fetch-Mode: no-cors
                                                                                                                                                                                                                                                  Sec-Fetch-Dest: empty
                                                                                                                                                                                                                                                  Sec-Fetch-Storage-Access: active
                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate, br, zstd
                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.9
                                                                                                                                                                                                                                                  2025-03-15 13:35:20 UTC1015INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                  Version: 735763701
                                                                                                                                                                                                                                                  Content-Type: application/json; charset=UTF-8
                                                                                                                                                                                                                                                  X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                                  Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws"
                                                                                                                                                                                                                                                  Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]}
                                                                                                                                                                                                                                                  Accept-CH: Downlink
                                                                                                                                                                                                                                                  Accept-CH: RTT
                                                                                                                                                                                                                                                  Accept-CH: Sec-CH-UA-Form-Factors
                                                                                                                                                                                                                                                  Accept-CH: Sec-CH-UA-Platform
                                                                                                                                                                                                                                                  Accept-CH: Sec-CH-UA-Platform-Version
                                                                                                                                                                                                                                                  Accept-CH: Sec-CH-UA-Full-Version
                                                                                                                                                                                                                                                  Accept-CH: Sec-CH-UA-Arch
                                                                                                                                                                                                                                                  Accept-CH: Sec-CH-UA-Model
                                                                                                                                                                                                                                                  Accept-CH: Sec-CH-UA-Bitness
                                                                                                                                                                                                                                                  Accept-CH: Sec-CH-UA-Full-Version-List
                                                                                                                                                                                                                                                  Accept-CH: Sec-CH-UA-WoW64
                                                                                                                                                                                                                                                  Permissions-Policy: unload=()
                                                                                                                                                                                                                                                  Document-Policy: expect-no-linked-resources
                                                                                                                                                                                                                                                  Content-Disposition: attachment; filename="f.txt"
                                                                                                                                                                                                                                                  Date: Sat, 15 Mar 2025 13:35:20 GMT
                                                                                                                                                                                                                                                  Server: gws
                                                                                                                                                                                                                                                  X-XSS-Protection: 0
                                                                                                                                                                                                                                                  X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                                  Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
                                                                                                                                                                                                                                                  Accept-Ranges: none
                                                                                                                                                                                                                                                  Vary: Accept-Encoding
                                                                                                                                                                                                                                                  Connection: close
                                                                                                                                                                                                                                                  Transfer-Encoding: chunked
                                                                                                                                                                                                                                                  2025-03-15 13:35:20 UTC35INData Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a
                                                                                                                                                                                                                                                  Data Ascii: 1d)]}'{"update":{"promos":{}}}
                                                                                                                                                                                                                                                  2025-03-15 13:35:20 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                  Data Ascii: 0


                                                                                                                                                                                                                                                  Click to jump to process

                                                                                                                                                                                                                                                  Click to jump to process

                                                                                                                                                                                                                                                  Click to dive into process behavior distribution

                                                                                                                                                                                                                                                  Click to jump to process

                                                                                                                                                                                                                                                  Target ID:0
                                                                                                                                                                                                                                                  Start time:09:35:05
                                                                                                                                                                                                                                                  Start date:15/03/2025
                                                                                                                                                                                                                                                  Path:C:\Users\user\Desktop\Build.exe
                                                                                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                                                                                  Commandline:"C:\Users\user\Desktop\Build.exe"
                                                                                                                                                                                                                                                  Imagebase:0x7d0000
                                                                                                                                                                                                                                                  File size:216'576 bytes
                                                                                                                                                                                                                                                  MD5 hash:7C77B3C5E87CD408D0565C369A4D9E2F
                                                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                  Yara matches:
                                                                                                                                                                                                                                                  • Rule: JoeSecurity_GenericStealer_9, Description: Yara detected Generic Stealer, Source: 00000000.00000002.1016471941.0000000007DFC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                  • Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 00000000.00000000.841274944.00000000007D2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                  • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.841274944.00000000007D2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                  • Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000000.00000000.841274944.00000000007D2000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen
                                                                                                                                                                                                                                                  • Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 00000000.00000002.1008445716.0000000002B6B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                  • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1008445716.0000000002B6B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                  • Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 00000000.00000002.1008445716.0000000002B6B000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                                                                                                  Reputation:low
                                                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                                                  Target ID:1
                                                                                                                                                                                                                                                  Start time:09:35:06
                                                                                                                                                                                                                                                  Start date:15/03/2025
                                                                                                                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                                                                                  Commandline:"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
                                                                                                                                                                                                                                                  Imagebase:0x460000
                                                                                                                                                                                                                                                  File size:236'544 bytes
                                                                                                                                                                                                                                                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                                                  Target ID:2
                                                                                                                                                                                                                                                  Start time:09:35:06
                                                                                                                                                                                                                                                  Start date:15/03/2025
                                                                                                                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                  Imagebase:0x7ff642da0000
                                                                                                                                                                                                                                                  File size:862'208 bytes
                                                                                                                                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                                                  Target ID:3
                                                                                                                                                                                                                                                  Start time:09:35:07
                                                                                                                                                                                                                                                  Start date:15/03/2025
                                                                                                                                                                                                                                                  Path:C:\Windows\SysWOW64\chcp.com
                                                                                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                                                                                  Commandline:chcp 65001
                                                                                                                                                                                                                                                  Imagebase:0xf0000
                                                                                                                                                                                                                                                  File size:12'800 bytes
                                                                                                                                                                                                                                                  MD5 hash:20A59FB950D8A191F7D35C4CA7DA9CAF
                                                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                  Reputation:moderate
                                                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                                                  Target ID:4
                                                                                                                                                                                                                                                  Start time:09:35:08
                                                                                                                                                                                                                                                  Start date:15/03/2025
                                                                                                                                                                                                                                                  Path:C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                                                                                  Commandline:netsh wlan show profile
                                                                                                                                                                                                                                                  Imagebase:0x1440000
                                                                                                                                                                                                                                                  File size:82'432 bytes
                                                                                                                                                                                                                                                  MD5 hash:4E89A1A088BE715D6C946E55AB07C7DF
                                                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                                                  Target ID:5
                                                                                                                                                                                                                                                  Start time:09:35:08
                                                                                                                                                                                                                                                  Start date:15/03/2025
                                                                                                                                                                                                                                                  Path:C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                                                                                  Commandline:findstr All
                                                                                                                                                                                                                                                  Imagebase:0xf90000
                                                                                                                                                                                                                                                  File size:29'696 bytes
                                                                                                                                                                                                                                                  MD5 hash:F1D4BE0E99EC734376FDE474A8D4EA3E
                                                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                                                  Target ID:6
                                                                                                                                                                                                                                                  Start time:09:35:08
                                                                                                                                                                                                                                                  Start date:15/03/2025
                                                                                                                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                                                                                  Commandline:"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
                                                                                                                                                                                                                                                  Imagebase:0x460000
                                                                                                                                                                                                                                                  File size:236'544 bytes
                                                                                                                                                                                                                                                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                                                  Target ID:7
                                                                                                                                                                                                                                                  Start time:09:35:08
                                                                                                                                                                                                                                                  Start date:15/03/2025
                                                                                                                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                  Imagebase:0x7ff642da0000
                                                                                                                                                                                                                                                  File size:862'208 bytes
                                                                                                                                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                                                  Target ID:8
                                                                                                                                                                                                                                                  Start time:09:35:09
                                                                                                                                                                                                                                                  Start date:15/03/2025
                                                                                                                                                                                                                                                  Path:C:\Windows\SysWOW64\chcp.com
                                                                                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                                                                                  Commandline:chcp 65001
                                                                                                                                                                                                                                                  Imagebase:0xf0000
                                                                                                                                                                                                                                                  File size:12'800 bytes
                                                                                                                                                                                                                                                  MD5 hash:20A59FB950D8A191F7D35C4CA7DA9CAF
                                                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                  Reputation:moderate
                                                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                                                  Target ID:9
                                                                                                                                                                                                                                                  Start time:09:35:09
                                                                                                                                                                                                                                                  Start date:15/03/2025
                                                                                                                                                                                                                                                  Path:C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                                                                                  Commandline:netsh wlan show networks mode=bssid
                                                                                                                                                                                                                                                  Imagebase:0x1440000
                                                                                                                                                                                                                                                  File size:82'432 bytes
                                                                                                                                                                                                                                                  MD5 hash:4E89A1A088BE715D6C946E55AB07C7DF
                                                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                                                  Target ID:10
                                                                                                                                                                                                                                                  Start time:09:35:15
                                                                                                                                                                                                                                                  Start date:15/03/2025
                                                                                                                                                                                                                                                  Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                                                  Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
                                                                                                                                                                                                                                                  Imagebase:0x7ff778810000
                                                                                                                                                                                                                                                  File size:3'388'000 bytes
                                                                                                                                                                                                                                                  MD5 hash:E81F54E6C1129887AEA47E7D092680BF
                                                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                                                  Target ID:11
                                                                                                                                                                                                                                                  Start time:09:35:16
                                                                                                                                                                                                                                                  Start date:15/03/2025
                                                                                                                                                                                                                                                  Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                                                  Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1964,i,11247005369938527612,18363969163184259848,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2136 /prefetch:3
                                                                                                                                                                                                                                                  Imagebase:0x7ff778810000
                                                                                                                                                                                                                                                  File size:3'388'000 bytes
                                                                                                                                                                                                                                                  MD5 hash:E81F54E6C1129887AEA47E7D092680BF
                                                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                                                  Reset < >