Play interactive tour

Edit tour

Analysis Report https://theragcompany.de/shaming.php

Overview

General Information

Sample URL:	https://theragcompany.de/shaming.php
Analysis ID:	356825
Infos:
Most interesting Screenshot:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Found iframes

HTML body contains low number of good links

Suspicious form URL found

Classification

Startup

System is w10x64

iexplore.exe (PID: 1288 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 5460 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1288 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Phishing:

Source: https://theragcompany.de/referenzen/	HTTP Parser: Iframe src: https://www.youtube.com/embed/sWLShHJm11w?feature=oembed
Source: https://theragcompany.de/referenzen/	HTTP Parser: Iframe src: https://www.youtube.com/embed/6zO8wnqD4xU?feature=oembed
Source: https://theragcompany.de/referenzen/	HTTP Parser: Iframe src: https://www.youtube.com/embed/FZ0uYCbpNBA?feature=oembed
Source: https://theragcompany.de/referenzen/	HTTP Parser: Iframe src: https://open.spotify.com/embed-podcast/episode/576CxG2WOtZkEJJea5OpjQ
Source: https://theragcompany.de/referenzen/	HTTP Parser: Iframe src: https://www.youtube.com/embed/sWLShHJm11w?feature=oembed
Source: https://theragcompany.de/referenzen/	HTTP Parser: Iframe src: https://www.youtube.com/embed/6zO8wnqD4xU?feature=oembed
Source: https://theragcompany.de/referenzen/	HTTP Parser: Iframe src: https://www.youtube.com/embed/FZ0uYCbpNBA?feature=oembed
Source: https://theragcompany.de/referenzen/	HTTP Parser: Iframe src: https://open.spotify.com/embed-podcast/episode/576CxG2WOtZkEJJea5OpjQ

Source: https://www.instagram.com/accounts/login/?next=/theragcompanyde/	HTTP Parser: Number of links: 0
Source: https://www.instagram.com/accounts/login/?next=/theragcompanyde/	HTTP Parser: Number of links: 0

Source: https://m.facebook.com/login.php?next=https%3A%2F%2Fm.facebook.com%2Fsharer%2Fsharer.php%3Fu%26session_id%3Dc1cae970-247d-4b1b-bdcf-d7f53f40b341&refsrc=https%3A%2F%2Fwww.facebook.com%2Fsharer%2Fsharer.php&_rdr	HTTP Parser: Form action: /login/device-based/login/async/?next=https%3A%2F%2Fm.facebook.com%2Fsharer%2Fsharer.php%3Fu%26session_id%3Dc1cae970-247d-4b1b-bdcf-d7f53f40b341&refsrc=https%3A%2F%2Fwww.facebook.com%2Fsharer%2Fsharer.php&lwv=100
Source: https://m.facebook.com/login.php?next=https%3A%2F%2Fm.facebook.com%2Fsharer%2Fsharer.php%3Fu%26session_id%3Dc1cae970-247d-4b1b-bdcf-d7f53f40b341&refsrc=https%3A%2F%2Fwww.facebook.com%2Fsharer%2Fsharer.php&_rdr	HTTP Parser: Form action: /login/device-based/login/async/?next=https%3A%2F%2Fm.facebook.com%2Fsharer%2Fsharer.php%3Fu%26session_id%3Dc1cae970-247d-4b1b-bdcf-d7f53f40b341&refsrc=https%3A%2F%2Fwww.facebook.com%2Fsharer%2Fsharer.php&lwv=100

Source: https://www.instagram.com/accounts/login/?next=/theragcompanyde/	HTTP Parser: No <meta name="author".. found
Source: https://m.facebook.com/login.php?next=https%3A%2F%2Fm.facebook.com%2Fsharer%2Fsharer.php%3Fu%26session_id%3Dc1cae970-247d-4b1b-bdcf-d7f53f40b341&refsrc=https%3A%2F%2Fwww.facebook.com%2Fsharer%2Fsharer.php&_rdr	HTTP Parser: No <meta name="author".. found
Source: https://theragcompany.de/marken/	HTTP Parser: No <meta name="author".. found
Source: https://theragcompany.de/	HTTP Parser: No <meta name="author".. found
Source: https://theragcompany.de/cart/	HTTP Parser: No <meta name="author".. found
Source: https://theragcompany.de/shaming.php	HTTP Parser: No <meta name="author".. found
Source: https://theragcompany.de/referenzen/	HTTP Parser: No <meta name="author".. found
Source: https://theragcompany.de/shop/	HTTP Parser: No <meta name="author".. found
Source: https://theragcompany.de/business-program/	HTTP Parser: No <meta name="author".. found
Source: https://www.instagram.com/accounts/login/?next=/theragcompanyde/	HTTP Parser: No <meta name="author".. found
Source: https://m.facebook.com/login.php?next=https%3A%2F%2Fm.facebook.com%2Fsharer%2Fsharer.php%3Fu%26session_id%3Dc1cae970-247d-4b1b-bdcf-d7f53f40b341&refsrc=https%3A%2F%2Fwww.facebook.com%2Fsharer%2Fsharer.php&_rdr	HTTP Parser: No <meta name="author".. found
Source: https://theragcompany.de/marken/	HTTP Parser: No <meta name="author".. found
Source: https://theragcompany.de/	HTTP Parser: No <meta name="author".. found
Source: https://theragcompany.de/cart/	HTTP Parser: No <meta name="author".. found
Source: https://theragcompany.de/shaming.php	HTTP Parser: No <meta name="author".. found
Source: https://theragcompany.de/referenzen/	HTTP Parser: No <meta name="author".. found
Source: https://theragcompany.de/shop/	HTTP Parser: No <meta name="author".. found
Source: https://theragcompany.de/business-program/	HTTP Parser: No <meta name="author".. found

Source: https://www.instagram.com/accounts/login/?next=/theragcompanyde/	HTTP Parser: No <meta name="copyright".. found
Source: https://m.facebook.com/login.php?next=https%3A%2F%2Fm.facebook.com%2Fsharer%2Fsharer.php%3Fu%26session_id%3Dc1cae970-247d-4b1b-bdcf-d7f53f40b341&refsrc=https%3A%2F%2Fwww.facebook.com%2Fsharer%2Fsharer.php&_rdr	HTTP Parser: No <meta name="copyright".. found
Source: https://theragcompany.de/marken/	HTTP Parser: No <meta name="copyright".. found
Source: https://theragcompany.de/	HTTP Parser: No <meta name="copyright".. found
Source: https://theragcompany.de/cart/	HTTP Parser: No <meta name="copyright".. found
Source: https://theragcompany.de/shaming.php	HTTP Parser: No <meta name="copyright".. found
Source: https://theragcompany.de/referenzen/	HTTP Parser: No <meta name="copyright".. found
Source: https://theragcompany.de/shop/	HTTP Parser: No <meta name="copyright".. found
Source: https://theragcompany.de/business-program/	HTTP Parser: No <meta name="copyright".. found
Source: https://www.instagram.com/accounts/login/?next=/theragcompanyde/	HTTP Parser: No <meta name="copyright".. found
Source: https://m.facebook.com/login.php?next=https%3A%2F%2Fm.facebook.com%2Fsharer%2Fsharer.php%3Fu%26session_id%3Dc1cae970-247d-4b1b-bdcf-d7f53f40b341&refsrc=https%3A%2F%2Fwww.facebook.com%2Fsharer%2Fsharer.php&_rdr	HTTP Parser: No <meta name="copyright".. found
Source: https://theragcompany.de/marken/	HTTP Parser: No <meta name="copyright".. found
Source: https://theragcompany.de/	HTTP Parser: No <meta name="copyright".. found
Source: https://theragcompany.de/cart/	HTTP Parser: No <meta name="copyright".. found
Source: https://theragcompany.de/shaming.php	HTTP Parser: No <meta name="copyright".. found
Source: https://theragcompany.de/referenzen/	HTTP Parser: No <meta name="copyright".. found
Source: https://theragcompany.de/shop/	HTTP Parser: No <meta name="copyright".. found
Source: https://theragcompany.de/business-program/	HTTP Parser: No <meta name="copyright".. found

Compliance:

Uses new MSVCR Dlls

Show sources

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Uses secure TLS version for HTTPS connections

Show sources

Source: unknown	HTTPS traffic detected: 185.104.28.118:443 -> 192.168.2.3:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.104.28.118:443 -> 192.168.2.3:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.104.28.118:443 -> 192.168.2.3:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.104.28.118:443 -> 192.168.2.3:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.104.28.118:443 -> 192.168.2.3:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.36:443 -> 192.168.2.3:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.36:443 -> 192.168.2.3:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.36:443 -> 192.168.2.3:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.36:443 -> 192.168.2.3:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.27.27:443 -> 192.168.2.3:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.27.27:443 -> 192.168.2.3:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.27.27:443 -> 192.168.2.3:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.27.27:443 -> 192.168.2.3:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.27.27:443 -> 192.168.2.3:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.27.27:443 -> 192.168.2.3:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.36:443 -> 192.168.2.3:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.36:443 -> 192.168.2.3:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.36:443 -> 192.168.2.3:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.36:443 -> 192.168.2.3:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.36:443 -> 192.168.2.3:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.36:443 -> 192.168.2.3:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.14:443 -> 192.168.2.3:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.14:443 -> 192.168.2.3:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.244.42.193:443 -> 192.168.2.3:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.244.42.193:443 -> 192.168.2.3:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.141:443 -> 192.168.2.3:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.141:443 -> 192.168.2.3:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.141:443 -> 192.168.2.3:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.141:443 -> 192.168.2.3:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.60.216.19:443 -> 192.168.2.3:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.60.216.19:443 -> 192.168.2.3:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.20.19:443 -> 192.168.2.3:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.20.19:443 -> 192.168.2.3:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.20.19:443 -> 192.168.2.3:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.20.19:443 -> 192.168.2.3:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.174:443 -> 192.168.2.3:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.174:443 -> 192.168.2.3:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.186.224.25:443 -> 192.168.2.3:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.186.224.25:443 -> 192.168.2.3:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.138.248:443 -> 192.168.2.3:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.138.248:443 -> 192.168.2.3:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.138.248:443 -> 192.168.2.3:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.138.248:443 -> 192.168.2.3:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.138.248:443 -> 192.168.2.3:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.138.248:443 -> 192.168.2.3:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.162:443 -> 192.168.2.3:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.162:443 -> 192.168.2.3:49785 version: TLS 1.2

Networking:

Source: cart[1].htm.2.dr	String found in binary or memory: <a rel="nofollow" href="https://www.facebook.com/sharer/sharer.php?u=https://theragcompany.de/cart/" target="_blank" class=" woodmart-social-icon social-facebook"> equals www.facebook.com (Facebook)
Source: cart[1].htm.2.dr	String found in binary or memory: <a rel="nofollow" href="https://www.facebook.com/theragcompanyde/" target="_blank" class=" woodmart-social-icon social-facebook"> equals www.facebook.com (Facebook)
Source: cart[1].htm.2.dr	String found in binary or memory: <div id="custom_html-3" class="widget_text woodmart-widget widget footer-widget widget_custom_html"><h5 class="widget-title">Kontakt</h5><div class="textwidget custom-html-widget"><ul class="menu"><li><a href="mailto: info@theragcompany.de"><div class="list-icon fa fa-envelope"> </div><span class="list-content">info@theragcompany.de</span></a></li><li><a href="tel: 015110555511"><div class="list-icon fa fa-whatsapp"> </div><span class="list-content">015110555511</span></a></li><li><a href="https://www.instagram.com/theragcompanyde/"><div class="list-icon fa fa-instagram"> </div><span class="list-content">theragcompanyde</span></a></li><li><a href="https://www.facebook.com/theragcompanyde/"><div class="list-icon fa fa-facebook"> </div><span class="list-content">theragcompanyde</span></a></li></ul></div></div></div> equals www.facebook.com (Facebook)
Source: bsuyEeCTvfm[1].js.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/09P_rcHKL4D/ equals www.facebook.com (Facebook)
Source: BwjU4B_qfpp[1].js.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/HAC-_9WTKIm/ equals www.facebook.com (Facebook)
Source: yo5TLBXW7Mx[1].js.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/MDzNl_j9yvg/ equals www.facebook.com (Facebook)
Source: yo5TLBXW7Mx[1].js.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/OKBVmODmb-W/ equals www.facebook.com (Facebook)
Source: WJqYlJL7tRX[1].js.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/V9vdYColc4k/ equals www.facebook.com (Facebook)
Source: VYBZ5aQNl5L[1].js.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/WRsJ32R7YJG/ equals www.facebook.com (Facebook)
Source: bsuyEeCTvfm[1].js.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/ZtTipMAcpq9/ equals www.facebook.com (Facebook)
Source: yo5TLBXW7Mx[1].js.2.dr	String found in binary or memory: * License: https://www.facebook.com/legal/license/e1uPfGqT9n9/ equals www.facebook.com (Facebook)
Source: base[1].js.2.dr	String found in binary or memory: (g.Sm(b,"www.youtube.com"),c=b.toString()):c=Xx(c);b=new Zx(c);b.set("cmo=pf","1");d&&b.set("cmo=td","a1.googlevideo.com");return b}; equals www.youtube.com (Youtube)
Source: {2AFFB837-763F-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: )https://www.facebook.com/theragcompanyde/ equals www.facebook.com (Facebook)
Source: {2AFFB837-763F-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: )https://www.facebook.com/theragcompanyde/! equals www.facebook.com (Facebook)
Source: {2AFFB837-763F-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: *https://www.facebook.c equals www.facebook.com (Facebook)
Source: ~DF98A4ECC7A66069B4.TMP.1.dr	String found in binary or memory: *https://www.facebook.com/theragcompanyde/ equals www.facebook.com (Facebook)
Source: ~DF98A4ECC7A66069B4.TMP.1.dr	String found in binary or memory: *https://www.facebook.com/theragcompanyde/s%3A%2F%2Fm.facebook.com%2Fsharer%2Fsharer.php%3Fu%26session_id%3Dc1cae970-247d-4b1b-bdcf-d7f53f40b341&refsrc=https%3A%2F%2Fwww.facebook.com%2Fsharer%2Fsharer.php&_rdr3f40b341&refsrc=https%3A%2F%2Fwww.facebook.com%2Fsharer%2Fsharer.php&_rdr equals www.facebook.com (Facebook)
Source: {2AFFB837-763F-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: -https://www.facebook.com/sharer/sharer.php?u= equals www.facebook.com (Facebook)
Source: {2AFFB837-763F-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: .https://www.facebook.c equals www.facebook.com (Facebook)
Source: {2AFFB837-763F-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: .https://www.facebook.cde/shaming.phpj equals www.facebook.com (Facebook)
Source: ~DF98A4ECC7A66069B4.TMP.1.dr	String found in binary or memory: .https://www.facebook.com/sharer/sharer.php?u= equals www.facebook.com (Facebook)
Source: ~DF98A4ECC7A66069B4.TMP.1.dr	String found in binary or memory: 2Fsharer%2Fsharer.php%3Fu%26session_id%3Dc1cae970-247d-4b1b-bdcf-d7f53f40b341&refsrc=https%3A%2F%2Fwww.facebook.com%2Fsharer%2Fsharer.php&_rdr equals www.facebook.com (Facebook)
Source: login[1].htm.2.dr	String found in binary or memory: </a></span></div></div><div class="_4g34"><div class="_3ztc"><span class="_52jc"><a href="/a/language.php?l=de_DE&lref=https%3A%2F%2Fm.facebook.com%2Flogin.php%3Fnext%3Dhttps%253A%252F%252Fm.facebook.com%252Fsharer%252Fsharer.php%253Fu%2526session_id%253Dc1cae970-247d-4b1b-bdcf-d7f53f40b341%26refsrc%3Dhttps%253A%252F%252Fwww.facebook.com%252Fsharer%252Fsharer.php&sref=legacy_mobile_settings_selector&gfid=AQANAzQ3cTuG3P4gYjI&refid=9" data-locale="de_DE" data-sigil="change_language">Deutsch</a></span></div><div class="_3ztc"><span class="_52jc"><a href="/a/language.php?l=it_IT&lref=https%3A%2F%2Fm.facebook.com%2Flogin.php%3Fnext%3Dhttps%253A%252F%252Fm.facebook.com%252Fsharer%252Fsharer.php%253Fu%2526session_id%253Dc1cae970-247d-4b1b-bdcf-d7f53f40b341%26refsrc%3Dhttps%253A%252F%252Fwww.facebook.com%252Fsharer%252Fsharer.php&sref=legacy_mobile_settings_selector&gfid=AQBol23wjtNvvyBe-LE&refid=9" data-locale="it_IT" data-sigil="change_language">Italiano</a></span></div><div class="_3ztc"><span class="_52jc"><a href="/a/language.php?l=es_LA&lref=https%3A%2F%2Fm.facebook.com%2Flogin.php%3Fnext%3Dhttps%253A%252F%252Fm.facebook.com%252Fsharer%252Fsharer.php%253Fu%2526session_id%253Dc1cae970-247d-4b1b-bdcf-d7f53f40b341%26refsrc%3Dhttps%253A%252F%252Fwww.facebook.com%252Fsharer%252Fsharer.php&sref=legacy_mobile_settings_selector&gfid=AQC0tmgopwVOXoaL-C8&refid=9" data-locale="es_LA" data-sigil="change_language">Espa equals www.facebook.com (Facebook)
Source: msapplication.xml0.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x122d9126,0x01d70a4c</date><accdate>0x122d9126,0x01d70a4c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x122d9126,0x01d70a4c</date><accdate>0x122d9126,0x01d70a4c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x123255f9,0x01d70a4c</date><accdate>0x123255f9,0x01d70a4c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x123255f9,0x01d70a4c</date><accdate>0x1234b871,0x01d70a4c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x1234b871,0x01d70a4c</date><accdate>0x1234b871,0x01d70a4c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x1234b871,0x01d70a4c</date><accdate>0x1234b871,0x01d70a4c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: base[1].js.2.dr	String found in binary or memory: FC("en",a.host_language);this.fj=!this.ga&&Math.random()<g.R(this.experiments,"web_player_api_logging_fraction");this.ia=!this.ga;this.enabledEngageTypes=new Set;this.deviceHasDisplay=b?!b.deviceIsAudioOnly:T(!0,a.deviceHasDisplay);this.Uc=EC(this.Uc,a.ismb);t=a;g.oA(this.experiments,"html5_qoe_intercept")?t=g.oA(this.experiments,"html5_qoe_intercept"):this.Aj?(t=t.vss_host\|\|"s.youtube.com",this.Z("www_for_videostats")&&"s.youtube.com"===t&&(t=$C(this.W)\|\|"www.youtube.com")):t="video.google.com"; equals www.youtube.com (Youtube)
Source: base[1].js.2.dr	String found in binary or memory: LK.prototype.replace=function(a,b){for(var c=g.q(a),d=c.next();!d.done;d=c.next())delete this.i[d.value.encryptedTokenJarContents];$ka(this,b)};MK.prototype.dn=function(a){var b,c,d=null===(b=a.responseContext)\|\|void 0===b?void 0:b.locationPlayabilityToken;void 0!==d&&(this.locationPlayabilityToken=d,this.i=void 0,"TVHTML5"===(null===(c=a.responseContext)\|\|void 0===c?void 0:c.clientName)?(this.localStorage=ala(this))&&this.localStorage.set("yt-location-playability-token",d,15552E3):g.Rq("YT_CL",JSON.stringify({E3:d}),15552E3,void 0,!0))};var PK;g.u(OK,Mr);OK.prototype.Ft=function(a,b){var c=Mr.prototype.Ft.call(this,a,b);return Object.assign(Object.assign({},c),this.i)};var tla=/[&\?]action_proxy=1/,sla=/[&\?]token=([\w-])/,ula=/[&\?]video_id=([\w-])/,vla=/[&\?]index=([\d-])/,wla=/[&\?]m_pos_ms=([\d-])/,zla=/[&\?]vvt=([\w-])/,Ala=/[&\?]mt=([\d-])/,nla="ca_type dt el flash u_tz u_his u_h u_w u_ah u_aw u_cd u_nplug u_nmime frm u_java bc bih biw brdim vis wgl".split(" "),xla="www.youtube-nocookie.com youtube-nocookie.com www.youtube-nocookie.com:443 youtube.googleapis.com www.youtubeedu.com www.youtubeeducation.com video.google.com redirector.gvt1.com".split(" "), equals www.youtube.com (Youtube)
Source: base[1].js.2.dr	String found in binary or memory: Uga=function(a,b){if(!a.i["0"]){var c=new wA("0","fakesb",void 0,new sA(0,0,0,void 0,void 0,"auto"),null,null,1);a.i["0"]=b?new hz(new Zx("http://www.youtube.com/videoplayback"),c,"fake"):new Gy(new Zx("http://www.youtube.com/videoplayback"),c,new hv(0,0),new hv(0,0),0,NaN)}}; equals www.youtube.com (Youtube)
Source: 58fb5608d564[1].js.2.dr	String found in binary or memory: __d(function(g,r,i,a,m,e,d){"use strict";Object.defineProperty(e,'__esModule',{value:!0});var n='https://www.facebook.com',t={ready:'ig_iframe_ready',success:'ig_iframe_success',error:'ig_iframe_error'},o=['terms','challenge'],_=Number((new Date).getTime()),c=function(n){n.total_latency=(new Date).getTime()-_,r(d[0]).IgFrCookieUpdaterFalcoEvent.log(function(){return n})},s=function(n){var t=r(d[1]).useContext(r(d[2]).FrCookieContext),o=t.dropDelay,_=t.lastDrop,c=t.setLastDrop,s=t.shouldThrottleDrop;r(d[1]).useLayoutEffect(function(){if(s){var t=Date.now();t-o>_&&(n(),c(t))}else n()},[n,o,_,c,s])},l=function(_){var l,N=_.data,E=a(d[1]).useState(N),u=i(d[3])(E,2),A=u[0],f=u[1],O=a(d[1]).useState(!1),F=i(d[3])(O,2),p=F[0],L=F[1],U=a(d[1]).useRef(null),B=Number(r(d[4]).useSelector(function(n){var t;return null===(t=r(d[5]).getViewer(n))\|\|void 0===t?void 0:t.id})),S=a(d[1]).useState({ig_user_id:B,iframe_origin:n}),w=i(d[3])(S,2),R=w[0],v=w[1];s(a(d[1]).useCallback(function(){i(d[6]).startFunnel(r(d[7]).OBA_FUNNEL,B);var n=r(d[8]).getPath(i(d[8]));if(R.browser_history_path=n,R.is_blacklisted=!1,R.local_storage_data=N,R.local_storage_same_as_api=!0,R.show_iframe=!1,R.local_storage_updated=!1,R.is_control_group=!1,R.is_local_storage_accessible=!1,o.some(function(t){return n.includes(t)})\|\|!i(d[9])._("16"))return i(d[6]).appendAction(r(d[7]).OBA_FUNNEL,B,r(d[7]).OBA_FUNNEL_NO_ENDPOINT_CALL),i(d[6]).endFunnel(r(d[7]).OBA_FUNNEL,B),R.is_blacklisted=!0,void c(R);null==N&&i(d[10]).incr('web.frcookie.local_storage.empty'),r(d[11]).getFrCookie(N).then(function(n){try{if(r(d[12]).shouldDropFrCookie()\|\|(R.is_control_group=!0),i(d[6]).appendAction(r(d[7]).OBA_FUNNEL,B,r(d[7]).OBA_FUNNEL_ENDPOINT_CALL),R.api_data=n.fr,n.fr!==N){R.local_storage_same_as_api=!1;var t=i(d[13]).getLocalStorage();null!=t?(R.is_local_storage_accessible=!0,''===n.fr?(t.removeItem("fr"),i(d[10]).incr('web.frcookie.local_storage.remove'),i(d[6]).appendAction(r(d[7]).OBA_FUNNEL,B,r(d[7]).OBA_FUNNEL_ENCRYPTED_PAYLOAD_ERROR),c(R)):(t.setItem("fr",n.fr),i(d[6]).appendAction(r(d[7]).OBA_FUNNEL,B,r(d[7]).OBA_FUNNEL_ENCRYPTED_PAYLOAD_SUCCESS),R.show_iframe=!0,R.local_storage_updated=!0,v(R),f(n.fr),L(!0),i(d[10]).incr('web.frcookie.local_storage.update'),i(d[6]).appendAction(r(d[7]).OBA_FUNNEL,B,r(d[7]).OBA_FUNNEL_ENCRYPTED_PAYLOAD_SUCCESS_AFTER_FRAME))):c(R)}else c(R)}catch(n){i(d[6]).appendActionWithPayload(r(d[7]).OBA_FUNNEL,B,r(d[7]).OBA_FUNNEL_ENCRYPTED_PAYLOAD_JS_ERROR,{error:JSON.stringify(n)}),R.exception=n.toString(),c(R)}}).catch(function(n){R.exception=n.toString(),c(R)})},[N,R,B]));var h=function(){L(!1);var n=i(d[13]).getLocalStorage();i(d[13]).isLocalStorageSupported()&&null!=n&&n.removeItem("fr")},C=function(){R.iframe_non_null=!1,R.iframe_content_window_non_null=!1;var t=U.current;if(null!=t){var o=JSON.parse(JSON.stringify({data:A}));R.iframe_payload=A,R.iframe_non_null=!0,null!=t.contentWindow&&(R.iframe_content_window_non_null=!0,i(d[6]).appendAction(r(d[7]).OBA_FUNNEL,B,r(d[7]).
Source: d4c57d525e26[1].js.2.dr	String found in binary or memory: __d(function(g,r,i,a,m,e,d){"use strict";function t(){return window.navigator&&window.navigator.share}Object.defineProperty(e,'__esModule',{value:!0}),e.hasNativeShare=t,e.getShareDescription=function(t,n){switch(n){case'guide':return r(d[0])(967,{username:t});case'photo':return r(d[0])(3596,{username:t});case'video':return r(d[0])(2031,{username:t});case'sidecar':default:return r(d[0])(2741,{username:t})}},e.shareWithNative=function(n,o,u){return t()\|\|i(d[1])(0),window.navigator.share({title:r(d[0])(1483),text:n,url:new(i(d[2]))(o).addQueryData('utm_source',u)})},e.getShareToFBURL=function(t){return new(i(d[2]))('https://www.facebook.com/sharer/sharer.php').addQueryData({app_id:r(d[3]).instagramWebFBAppId,u:t}).toString()},e.getShareToMessengerURL=function(t){var n;return r(d[4]).isMobile()?(n=new(i(d[2]))('fb-messenger://share')).addQueryData({app_id:r(d[3]).instagramWebFBAppId,link:t}):(n=new(i(d[2]))('https://www.facebook.com/dialog/send')).addQueryData({app_id:r(d[3]).instagramWebFBAppId,link:t,redirect_uri:t}),n.toString()},e.getShareToWhatsAppURL=function(t,n){return new(i(d[2]))('whatsapp://send').addQueryData({text:n+": "+t}).toString()},e.getShareToTwitterURL=function(t,n){return new(i(d[2]))('https://twitter.com/share').addQueryData({text:n,url:t}).toString()},e.getShareToEmailURL=function(t,n){var o=n+": "+t;return"mailto:?subject="+encodeURIComponent(n)+"&body="+encodeURIComponent(o)}},14942216,[9895940,9699436,10158310,10158204,9764909]); equals www.facebook.com (Facebook)
Source: d4c57d525e26[1].js.2.dr	String found in binary or memory: __d(function(g,r,i,a,m,e,d){"use strict";function t(){return window.navigator&&window.navigator.share}Object.defineProperty(e,'__esModule',{value:!0}),e.hasNativeShare=t,e.getShareDescription=function(t,n){switch(n){case'guide':return r(d[0])(967,{username:t});case'photo':return r(d[0])(3596,{username:t});case'video':return r(d[0])(2031,{username:t});case'sidecar':default:return r(d[0])(2741,{username:t})}},e.shareWithNative=function(n,o,u){return t()\|\|i(d[1])(0),window.navigator.share({title:r(d[0])(1483),text:n,url:new(i(d[2]))(o).addQueryData('utm_source',u)})},e.getShareToFBURL=function(t){return new(i(d[2]))('https://www.facebook.com/sharer/sharer.php').addQueryData({app_id:r(d[3]).instagramWebFBAppId,u:t}).toString()},e.getShareToMessengerURL=function(t){var n;return r(d[4]).isMobile()?(n=new(i(d[2]))('fb-messenger://share')).addQueryData({app_id:r(d[3]).instagramWebFBAppId,link:t}):(n=new(i(d[2]))('https://www.facebook.com/dialog/send')).addQueryData({app_id:r(d[3]).instagramWebFBAppId,link:t,redirect_uri:t}),n.toString()},e.getShareToWhatsAppURL=function(t,n){return new(i(d[2]))('whatsapp://send').addQueryData({text:n+": "+t}).toString()},e.getShareToTwitterURL=function(t,n){return new(i(d[2]))('https://twitter.com/share').addQueryData({text:n,url:t}).toString()},e.getShareToEmailURL=function(t,n){var o=n+": "+t;return"mailto:?subject="+encodeURIComponent(n)+"&body="+encodeURIComponent(o)}},14942216,[9895940,9699436,10158310,10158204,9764909]); equals www.twitter.com (Twitter)
Source: 5f29fc3b8e16[1].js.2.dr	String found in binary or memory: __d(function(g,r,i,a,m,e,d){"use strict";function t(t){var n,o=i(d[0]).getSessionStorage(),c=u.reduce(function(t){return t+r(d[1]).randomUint32().toString(36)},'');null!=o&&o.setItem(p,c);var f="https://www.instagram.com"+r(d[2]).SIGNUP_PATH,_=(n={},n[p]=c,n[v]=t,n),h=r(d[3]).isMobile()?s:l,S=r(d[4]).appendQueryParams(h,{client_id:r(d[5]).instagramFBAppId,redirect_uri:f,state:JSON.stringify(_),scope:'email',response_type:'code,granted_scopes',locale:r(d[6]).getLocale()});r(d[7]).redirect(S)}function n(){var t=i(d[0]).getSessionStorage(),n=null;return null!=t&&(n=t.getItem(p),t.removeItem(p)),null!=n&&''!==n?n:null}function o(){return(o=i(d[9])(i(d[10]).mark(function t(){var n,o,u;return i(d[10]).wrap(function(t){for(;;)switch(t.prev=t.next){case 0:return t.next=2,new Promise(function(t,n){i(d[11]).sdkReady(function(){i(d[11]).getLoginStatus(!0).then(function(o){'connected'===o.status?t(o):n()}).catch(function(t){n(t)})})});case 2:return o=t.sent,u=null===(n=o.authResponse)\|\|void 0===n?void 0:n.accessToken,c(u),t.abrupt("return",o);case 6:case"end":return t.stop()}},t)}))).apply(this,arguments)}function c(t){if(null!=t&&''!==t){var n;null===(n=r(d[12]).getStorageForUser(r(d[6]).getViewerId()))\|\|void 0===n\|\|n.setItem(_,t)}}Object.defineProperty(e,'__esModule',{value:!0});var u=[0,0,0,0,0,0,0,0],s='https://m.facebook.com/dialog/oauth',l='https://www.facebook.com/dialog/oauth',f='NewUserInterstitial.profile_picture_url',_='fbAccessToken',p='fbLoginKey',v='fbLoginReturnURL';e.PROFILE_PICTURE_URL_STORAGE_KEY=f,e.FB_ACCESS_TOKEN=_,e.FB_LOGIN_KEY=p,e.FB_LOGIN_RETURN_URL=v,e.FB_PLAIN_TOKEN='fbPlainToken',e.getFBAccessToken=t,e.doesFBLoginKeyMatch=function(t){var o=n();return null!=o&&''!==o&&t===o},e.checkGraphDifferentiationQE=function(){switch(i(d[8])._("12","0",{silent:!0})){case 5:return i(d[7]).location.pathname===r(d[2]).DISCOVER_PEOPLE_PATH;case-1:return!0;case 0:default:return!1}},e.connectToFacebook=function(){return o.apply(this,arguments)},e.saveAccessToken=c,e.redirectToFBOAuth=function(n,o,c,u){return void 0===c&&(c='fb_connect'),void 0===u&&(u=''),r(d[13]).logAction_DEPRECATED('connectToFacebookClick',{source:o}),r(d[14]).logLoggedOutCtaEvent({ctaType:c,ctaVersion:u,eventName:'fb_connect_click'}),new Promise(function(o,c){t(n)})},e.storeProfilePictureURL=function(t){var n=i(d[0]).getSessionStorage();i(d[0]).isSessionStorageSupported()&&null!=n&&(t.data.is_silhouette\|\|null==t.data.url\|\|''===t.data.url?n.removeItem(f):n.setItem(f,i(d[15])(t.data.url)))},e.isFBConnected=function(t){var n;return(null===(n=t.auth)\|\|void 0===n?void 0:n.isFBLoggedIn)\|\|!1},e.isFBCUnique=function(t){var n=r(d[16]).getLoginNonces();return!1===Object.keys(n).some(function(o){return n[o].username===t})}},10289245,[9764884,18743328,10158339,9764909,14417922,10158204,9764880,9895941,9895961,9830402,9830403,12779522,15859715,9764900,12779523,9895943,9895948]); equals www.facebook.com (Facebook)
Source: login[1].htm.2.dr	String found in binary or memory: ais (France)</a></span></div><div class="_3ztc"><span class="_52jc"><a href="/a/language.php?l=pt_PT&lref=https%3A%2F%2Fm.facebook.com%2Flogin.php%3Fnext%3Dhttps%253A%252F%252Fm.facebook.com%252Fsharer%252Fsharer.php%253Fu%2526session_id%253Dc1cae970-247d-4b1b-bdcf-d7f53f40b341%26refsrc%3Dhttps%253A%252F%252Fwww.facebook.com%252Fsharer%252Fsharer.php&sref=legacy_mobile_settings_selector&gfid=AQCJ2PFpJN9fH7uOCn4&refid=9" data-locale="pt_PT" data-sigil="change_language">Portugu equals www.facebook.com (Facebook)
Source: business-program[1].htm.2.dr	String found in binary or memory: ber Uns</span></a></li><li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-28 item-level-0"><a href="https://theragcompany.de/contact/" class="woodmart-nav-link"><span class="nav-link-text">Kontakt</span></a></li><li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-1689 item-level-0"><a href="https://theragcompany.de/waschanleitung/" class="woodmart-nav-link"><span class="nav-link-text">Waschanleitung</span></a></li><li class="menu-item item-level-0 menu-item-wishlist"><a href="https://theragcompany.de/wunschzettel/" class="woodmart-nav-link"><span class="nav-link-text">Wishlist</span></a></li><li class="menu-item item-level-0 my-account-with-username my-account-with-text login-side-opener menu-item-register"><a href="https://theragcompany.de/account/">Login / Register</a></li></ul></div></div></div><div class="cart-widget-side"><div class="widget-heading"><h3 class="widget-title">Shopping cart</h3><a href="#" class="close-side-widget wd-cross-button wd-with-text-left">close</a></div><div class="widget woocommerce widget_shopping_cart"><div class="widget_shopping_cart_content"></div></div></div><div class="login-form-side"><div class="widget-heading"><h3 class="widget-title">Sign in</h3><a href="#" class="close-side-widget wd-cross-button wd-with-text-left">close</a></div><form method="post" class="login woocommerce-form woocommerce-form-login" action="https://theragcompany.de/account/" ><p class="woocommerce-FormRow woocommerce-FormRow--wide form-row form-row-wide form-row-username"><label for="username">Benutzername oder E-Mail <span class="required"></span></label><input type="text" class="woocommerce-Input woocommerce-Input--text input-text" name="username" id="username" autocomplete="username" value="" /></p><p class="woocommerce-FormRow woocommerce-FormRow--wide form-row form-row-wide form-row-password"><label for="password">Password <span class="required"></span></label><input class="woocommerce-Input woocommerce-Input--text input-text" type="password" name="password" id="password" autocomplete="current-password" /></p><p class="form-row"><input type="hidden" id="woocommerce-login-nonce" name="woocommerce-login-nonce" value="b44f8c73cc" /><input type="hidden" name="_wp_http_referer" value="/business-program/" /><button type="submit" class="button woocommerce-button woocommerce-form-login__submit" name="login" value="Log in">Log in</button></p><div class="login-form-footer"><a href="https://theragcompany.de/account/lost-password/" class="woocommerce-LostPassword lost_password">Lost your password?</a><label class="woocommerce-form__label woocommerce-form__label-for-checkbox woocommerce-form-login__rememberme"><input class="woocommerce-form__input woocommerce-form__input-checkbox" name="rememberme" type="checkbox" value="forever" /><span>Remember me</span></label></div></form><div class="create-account-question"><span class="create-account-text">No account yet?</span><a href="http
Source: marken[1].htm.2.dr	String found in binary or memory: ber Uns</span></a></li><li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-28 item-level-0"><a href="https://theragcompany.de/contact/" class="woodmart-nav-link"><span class="nav-link-text">Kontakt</span></a></li><li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-1689 item-level-0"><a href="https://theragcompany.de/waschanleitung/" class="woodmart-nav-link"><span class="nav-link-text">Waschanleitung</span></a></li><li class="menu-item item-level-0 menu-item-wishlist"><a href="https://theragcompany.de/wunschzettel/" class="woodmart-nav-link"><span class="nav-link-text">Wishlist</span></a></li><li class="menu-item item-level-0 my-account-with-username my-account-with-text login-side-opener menu-item-register"><a href="https://theragcompany.de/account/">Login / Register</a></li></ul></div></div></div><div class="cart-widget-side"><div class="widget-heading"><h3 class="widget-title">Shopping cart</h3><a href="#" class="close-side-widget wd-cross-button wd-with-text-left">close</a></div><div class="widget woocommerce widget_shopping_cart"><div class="widget_shopping_cart_content"></div></div></div><div class="login-form-side"><div class="widget-heading"><h3 class="widget-title">Sign in</h3><a href="#" class="close-side-widget wd-cross-button wd-with-text-left">close</a></div><form method="post" class="login woocommerce-form woocommerce-form-login" action="https://theragcompany.de/account/" ><p class="woocommerce-FormRow woocommerce-FormRow--wide form-row form-row-wide form-row-username"><label for="username">Benutzername oder E-Mail <span class="required"></span></label><input type="text" class="woocommerce-Input woocommerce-Input--text input-text" name="username" id="username" autocomplete="username" value="" /></p><p class="woocommerce-FormRow woocommerce-FormRow--wide form-row form-row-wide form-row-password"><label for="password">Password <span class="required"></span></label><input class="woocommerce-Input woocommerce-Input--text input-text" type="password" name="password" id="password" autocomplete="current-password" /></p><p class="form-row"><input type="hidden" id="woocommerce-login-nonce" name="woocommerce-login-nonce" value="b44f8c73cc" /><input type="hidden" name="_wp_http_referer" value="/marken/" /><button type="submit" class="button woocommerce-button woocommerce-form-login__submit" name="login" value="Log in">Log in</button></p><div class="login-form-footer"><a href="https://theragcompany.de/account/lost-password/" class="woocommerce-LostPassword lost_password">Lost your password?</a><label class="woocommerce-form__label woocommerce-form__label-for-checkbox woocommerce-form-login__rememberme"><input class="woocommerce-form__input woocommerce-form__input-checkbox" name="rememberme" type="checkbox" value="forever" /><span>Remember me</span></label></div></form><div class="create-account-question"><span class="create-account-text">No account yet?</span><a href="https://therag
Source: referenzen[1].htm.2.dr	String found in binary or memory: ber Uns</span></a></li><li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-28 item-level-0"><a href="https://theragcompany.de/contact/" class="woodmart-nav-link"><span class="nav-link-text">Kontakt</span></a></li><li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-1689 item-level-0"><a href="https://theragcompany.de/waschanleitung/" class="woodmart-nav-link"><span class="nav-link-text">Waschanleitung</span></a></li><li class="menu-item item-level-0 menu-item-wishlist"><a href="https://theragcompany.de/wunschzettel/" class="woodmart-nav-link"><span class="nav-link-text">Wishlist</span></a></li><li class="menu-item item-level-0 my-account-with-username my-account-with-text login-side-opener menu-item-register"><a href="https://theragcompany.de/account/">Login / Register</a></li></ul></div></div></div><div class="cart-widget-side"><div class="widget-heading"><h3 class="widget-title">Shopping cart</h3><a href="#" class="close-side-widget wd-cross-button wd-with-text-left">close</a></div><div class="widget woocommerce widget_shopping_cart"><div class="widget_shopping_cart_content"></div></div></div><div class="login-form-side"><div class="widget-heading"><h3 class="widget-title">Sign in</h3><a href="#" class="close-side-widget wd-cross-button wd-with-text-left">close</a></div><form method="post" class="login woocommerce-form woocommerce-form-login" action="https://theragcompany.de/account/" ><p class="woocommerce-FormRow woocommerce-FormRow--wide form-row form-row-wide form-row-username"><label for="username">Benutzername oder E-Mail <span class="required"></span></label><input type="text" class="woocommerce-Input woocommerce-Input--text input-text" name="username" id="username" autocomplete="username" value="" /></p><p class="woocommerce-FormRow woocommerce-FormRow--wide form-row form-row-wide form-row-password"><label for="password">Password <span class="required"></span></label><input class="woocommerce-Input woocommerce-Input--text input-text" type="password" name="password" id="password" autocomplete="current-password" /></p><p class="form-row"><input type="hidden" id="woocommerce-login-nonce" name="woocommerce-login-nonce" value="b44f8c73cc" /><input type="hidden" name="_wp_http_referer" value="/referenzen/" /><button type="submit" class="button woocommerce-button woocommerce-form-login__submit" name="login" value="Log in">Log in</button></p><div class="login-form-footer"><a href="https://theragcompany.de/account/lost-password/" class="woocommerce-LostPassword lost_password">Lost your password?</a><label class="woocommerce-form__label woocommerce-form__label-for-checkbox woocommerce-form-login__rememberme"><input class="woocommerce-form__input woocommerce-form__input-checkbox" name="rememberme" type="checkbox" value="forever" /><span>Remember me</span></label></div></form><div class="create-account-question"><span class="create-account-text">No account yet?</span><a href="https://th
Source: LETOMXZM.htm.2.dr	String found in binary or memory: ber Uns</span></a></li><li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-28 item-level-0"><a href="https://theragcompany.de/contact/" class="woodmart-nav-link"><span class="nav-link-text">Kontakt</span></a></li><li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-1689 item-level-0"><a href="https://theragcompany.de/waschanleitung/" class="woodmart-nav-link"><span class="nav-link-text">Waschanleitung</span></a></li><li class="menu-item item-level-0 menu-item-wishlist"><a href="https://theragcompany.de/wunschzettel/" class="woodmart-nav-link"><span class="nav-link-text">Wishlist</span></a></li><li class="menu-item item-level-0 my-account-with-username my-account-with-text login-side-opener menu-item-register"><a href="https://theragcompany.de/account/">Login / Register</a></li></ul></div></div></div><div class="cart-widget-side"><div class="widget-heading"><h3 class="widget-title">Shopping cart</h3><a href="#" class="close-side-widget wd-cross-button wd-with-text-left">close</a></div><div class="widget woocommerce widget_shopping_cart"><div class="widget_shopping_cart_content"></div></div></div><div class="login-form-side"><div class="widget-heading"><h3 class="widget-title">Sign in</h3><a href="#" class="close-side-widget wd-cross-button wd-with-text-left">close</a></div><form method="post" class="login woocommerce-form woocommerce-form-login" action="https://theragcompany.de/account/" ><p class="woocommerce-FormRow woocommerce-FormRow--wide form-row form-row-wide form-row-username"><label for="username">Username or email <span class="required"></span></label><input type="text" class="woocommerce-Input woocommerce-Input--text input-text" name="username" id="username" autocomplete="username" value="" /></p><p class="woocommerce-FormRow woocommerce-FormRow--wide form-row form-row-wide form-row-password"><label for="password">Password <span class="required"></span></label><input class="woocommerce-Input woocommerce-Input--text input-text" type="password" name="password" id="password" autocomplete="current-password" /></p><p class="form-row"><input type="hidden" id="woocommerce-login-nonce" name="woocommerce-login-nonce" value="b44f8c73cc" /><input type="hidden" name="_wp_http_referer" value="/" /><button type="submit" class="button woocommerce-button woocommerce-form-login__submit" name="login" value="Log in">Log in</button></p><div class="login-form-footer"><a href="https://theragcompany.de/account/lost-password/" class="woocommerce-LostPassword lost_password">Lost your password?</a><label class="woocommerce-form__label woocommerce-form__label-for-checkbox woocommerce-form-login__rememberme"><input class="woocommerce-form__input woocommerce-form__input-checkbox" name="rememberme" type="checkbox" value="forever" /><span>Remember me</span></label></div></form><div class="create-account-question"><span class="create-account-text">No account yet?</span><a href="https://theragcompany.de/acc
Source: shop[1].htm.2.dr	String found in binary or memory: ber Uns</span></a></li><li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-28 item-level-0"><a href="https://theragcompany.de/contact/" class="woodmart-nav-link"><span class="nav-link-text">Kontakt</span></a></li><li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-1689 item-level-0"><a href="https://theragcompany.de/waschanleitung/" class="woodmart-nav-link"><span class="nav-link-text">Waschanleitung</span></a></li><li class="menu-item item-level-0 menu-item-wishlist"><a href="https://theragcompany.de/wunschzettel/" class="woodmart-nav-link"><span class="nav-link-text">Wishlist</span></a></li><li class="menu-item item-level-0 my-account-with-username my-account-with-text login-side-opener menu-item-register"><a href="https://theragcompany.de/account/">Login / Register</a></li></ul></div></div></div><div class="cart-widget-side"><div class="widget-heading"><h3 class="widget-title">Shopping cart</h3><a href="#" class="close-side-widget wd-cross-button wd-with-text-left">close</a></div><div class="widget woocommerce widget_shopping_cart"><div class="widget_shopping_cart_content"></div></div></div><div class="login-form-side"><div class="widget-heading"><h3 class="widget-title">Sign in</h3><a href="#" class="close-side-widget wd-cross-button wd-with-text-left">close</a></div><form method="post" class="login woocommerce-form woocommerce-form-login" action="https://theragcompany.de/account/" ><p class="woocommerce-FormRow woocommerce-FormRow--wide form-row form-row-wide form-row-username"><label for="username">Username or email <span class="required"></span></label><input type="text" class="woocommerce-Input woocommerce-Input--text input-text" name="username" id="username" autocomplete="username" value="" /></p><p class="woocommerce-FormRow woocommerce-FormRow--wide form-row form-row-wide form-row-password"><label for="password">Password <span class="required"></span></label><input class="woocommerce-Input woocommerce-Input--text input-text" type="password" name="password" id="password" autocomplete="current-password" /></p><p class="form-row"><input type="hidden" id="woocommerce-login-nonce" name="woocommerce-login-nonce" value="b44f8c73cc" /><input type="hidden" name="_wp_http_referer" value="/shop/" /><button type="submit" class="button woocommerce-button woocommerce-form-login__submit" name="login" value="Log in">Log in</button></p><div class="login-form-footer"><a href="https://theragcompany.de/account/lost-password/" class="woocommerce-LostPassword lost_password">Lost your password?</a><label class="woocommerce-form__label woocommerce-form__label-for-checkbox woocommerce-form-login__rememberme"><input class="woocommerce-form__input woocommerce-form__input-checkbox" name="rememberme" type="checkbox" value="forever" /><span>Remember me</span></label></div></form><div class="create-account-question"><span class="create-account-text">No account yet?</span><a href="https://theragcompany.d
Source: 6zO8wnqD4xU[1].htm.2.dr	String found in binary or memory: cherkunde mit TM Details \\u0026 The Rag Company\",\"navigationEndpoint\":{\"clickTrackingParams\":\"CAYQ46ICIhMIgujLkbaA7wIVXolVCh2XCAcd\",\"urlEndpoint\":{\"url\":\"http://www.youtube.com/watch?v\u003d6zO8wnqD4xU\"}}}]},\"subtitle\":{\"runs\":[{\"text\":\"3.5K views equals www.youtube.com (Youtube)
Source: sWLShHJm11w[1].htm.2.dr	String found in binary or memory: chern - The Rag Company \| DCon\",\"navigationEndpoint\":{\"clickTrackingParams\":\"CAYQ46ICIhMI-rLMkbaA7wIVQb5VCh1rMgCO\",\"urlEndpoint\":{\"url\":\"http://www.youtube.com/watch?v\u003dsWLShHJm11w\"}}}]},\"subtitle\":{\"runs\":[{\"text\":\"3.1K views equals www.youtube.com (Youtube)
Source: referenzen[1].htm.2.dr	String found in binary or memory: chern - The Rag Company \| DCon" width="500" height="281" src="https://www.youtube.com/embed/sWLShHJm11w?feature=oembed" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe></div></div></div></div></div></div><div class="wpb_column vc_column_container vc_col-sm-4 vc_hidden-md vc_hidden-sm vc_hidden-xs"><div class="vc_column-inner"><div class="wpb_wrapper"><div class="author-area text-left color-scheme-dark referenzenimage"><div class="author-avatar"><img class="woodmart-lazy-load woodmart-lazy-fade author-area-image" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKCAYAAACNMs+9AAABiklEQVQYlQXBy04TUQCA4X8uOnPSpqN04gR3HYJpcGlJ1cDC65J6WSMUCAsjicaFqAHeQd0ItS115SWAl0cwKg9gCZEmjWlZdE5NZ4y200mD36cAtFotlh89sfP5mYUg+JPVdY1+FH3ber9VKG0WfwMoAIWNVxcdx/kQj8fsXi9ECBPf90kkrFa9Xs/l52a/awvzi/bk5MSXk0NDdrvd5unjFarVKrkbOQzTiA0GgylhiLJ66/bNxSAIbNtO8unjZ9wRl2QyyfrLDYRpApyavjM9p7uum4Ujqj/2ME2Te0t3OQKKhSKNRoOUmyLq9y+oAPFYnGvXr+I4Dul0mtPDw4S9kOz5LCcsCyEEuvTkrmUlpkDh8pVLPH/2AiEEDx7exzAM/uldPE/uqpXK63VN1WSz2eRcJkOn08HzJJnxDIfNQ1RVkaViqaAAbJYrE66b2vaDwD4zOoqUEsM06Xa78uDnQW42P/NVA9jZ2f51TDteGjs75oe98G+tVtuP+lH57Zt386trK/sA/wFJwZYfDcDcJQAAAABJRU5ErkJggg==" data-wood-src="https://theragcompany.de/wp-content/uploads/2020/05/Autolack-Affen-350x350.png" width="350" height="350" alt="Autolack Affen" title="Autolack Affen" /></div><h4 class="title author-name"> Autolackaffen</h4><div class="author-area-info"></p><p>Webarten von Mikrofasert equals www.youtube.com (Youtube)
Source: {2AFFB837-763F-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: facebook.com%2Fsharer%2Fsharer.php%3Fu%26session_id%3Dc1cae970-247d-4b1b-bdcf-d7f53f40b341&refsrc=https%3A%2F%2Fwww.facebook.com%2Fsharer%2Fsharer.php&_rdr equals www.facebook.com (Facebook)
Source: {2AFFB837-763F-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: facebook.com%2Fsharer%2Fsharer.php%3Fu%26session_id%3Dc1cae970-247d-4b1b-bdcf-d7f53f40b341&refsrc=https%3A%2F%2Fwww.facebook.com%2Fsharer%2Fsharer.php&_rdrRoot Entry equals www.facebook.com (Facebook)
Source: marken[1].htm.2.dr	String found in binary or memory: ftsbedingungen</a></li><li><a href="https://www.theragcompany.de/contact/">Impressum</a></li></ul></div></div></div><div class="footer-column footer-column-2 col-12 col-sm-4"><div id="custom_html-4" class="widget_text woodmart-widget widget footer-widget widget_custom_html"><h5 class="widget-title">Zahlung & Versand</h5><div class="textwidget custom-html-widget"><div height="auto" style="float:left;max-width:200px;"><a href="https://www.theragcompany.de/zahlung-versand/"><img src="https://www.theragcompany.de/wp-content/uploads/2020/06/PayPal-Logo-e1595003724191.png" alt="PayPal logo" width="200" height="auto" align="left" style="float:left;margin-bottom:20px;"></a><a href="https://www.theragcompany.de/zahlung-versand/"><img src="https://theragcompany.de/wp-content/uploads/2021/02/Vorkasse-Logo-e1613587708182.png" alt="PayPal logo" width="200" height="auto" align="left" style="float:left;margin-bottom:20px;"></a><a href="https://www.theragcompany.de/zahlung-versand/"><img src="https://www.theragcompany.de/wp-content/uploads/2020/06/DHL-Logo-e1595003749295.png" alt="DHL logo" width="200" height="auto" align="left" style="float:left;"></a></div></div></div></div><div class="footer-column footer-column-3 col-12 col-sm-4"><div id="custom_html-3" class="widget_text woodmart-widget widget footer-widget widget_custom_html"><h5 class="widget-title">Kontakt</h5><div class="textwidget custom-html-widget"><ul class="menu"><li><a href="mailto: info@theragcompany.de"><div class="list-icon fa fa-envelope"> </div><span class="list-content">info@theragcompany.de</span></a></li><li><a href="tel: 015110555511"><div class="list-icon fa fa-whatsapp"> </div><span class="list-content">015110555511</span></a></li><li><a href="https://www.instagram.com/theragcompanyde/"><div class="list-icon fa fa-instagram"> </div><span class="list-content">theragcompanyde</span></a></li><li><a href="https://www.facebook.com/theragcompanyde/"><div class="list-icon fa fa-facebook"> </div><span class="list-content">theragcompanyde</span></a></li></ul></div></div></div></aside></div></footer></div><div class="woodmart-close-side"></div><div class="woodmart-search-full-screen"><span class="woodmart-close-search wd-cross-button">close</span><form role="search" method="get" class="searchform woodmart-ajax-search" action="https://theragcompany.de/" data-thumbnail="1" data-price="1" data-post_type="product" data-count="20" data-sku="0" data-symbols_count="3"><input type="text" class="s" placeholder="Search for products" value="" name="s" /><input type="hidden" name="post_type" value="product"><button type="submit" class="searchsubmit"> Search </button></form><div class="search-info-text"><span>Start typing to see products you are looking for.</span></div><div class="search-results-wrapper"><div class="woodmart-scroll"><div class="woodmart-search-results woodmart-scroll-content"></div></div><div class="woodmart-search-loader wd-fill"></div></div></div> equals www.facebo
Source: base[1].js.2.dr	String found in binary or memory: g.eO.prototype.l=function(a){var b=this;cpa(this);var c=a.Fx,d=this.api.T();"GENERIC_WITHOUT_LINK"!==c\|\|d.I?"TOO_MANY_REQUESTS"===c?(d=this.api.getVideoData(),this.Fc(hO(this,"TOO_MANY_REQUESTS_WITH_LINK",d.ul(),void 0,void 0,void 0,!1))):"HTML5_NO_AVAILABLE_FORMATS_FALLBACK"!==c\|\|d.I?this.Fc(g.fO(a.errorMessage)):this.Fc(hO(this,"HTML5_NO_AVAILABLE_FORMATS_FALLBACK_WITH_LINK_SHORT","//www.youtube.com/supported_browsers")):(a=d.hostLanguage,c="//support.google.com/youtube/?p=player_error1",a&&(c= equals www.youtube.com (Youtube)
Source: base[1].js.2.dr	String found in binary or memory: g.jD=function(a){a=$C(a.W);return"www.youtube-nocookie.com"===a?"www.youtube.com":a}; equals www.youtube.com (Youtube)
Source: base[1].js.2.dr	String found in binary or memory: g.k.clone=function(){var a=new Wm;a.u=this.u;this.i&&(a.i=this.i.clone(),a.l=this.l);return a};var cn="://secure-...imrworldwide.com/ ://cdn.imrworldwide.com/ ://aksecure.imrworldwide.com/ ://[^.]*.moatads.com ://youtube[0-9]+.moatpixel.com ://pm.adsafeprotected.com/youtube ://pm.test-adsafeprotected.com/youtube ://e[0-9]+.yt.srs.doubleverify.com www.google.com/pagead/xsul www.youtube.com/pagead/slav".split(" "),Bda=/\bocr\b/;var Cda=/(?:\[\|%5B)([a-zA-Z0-9_]+)(?:\]\|%5D)/g;var fD={mX:"LIVING_ROOM_APP_MODE_UNSPECIFIED",jX:"LIVING_ROOM_APP_MODE_MAIN",iX:"LIVING_ROOM_APP_MODE_KIDS",kX:"LIVING_ROOM_APP_MODE_MUSIC",lX:"LIVING_ROOM_APP_MODE_UNPLUGGED",hX:"LIVING_ROOM_APP_MODE_GAMING"},Gya={G_:"PLAYBACK_TYPE_UNKNOWN",A_:"PLAYBACK_TYPE_APPLICATION",z_:"PLAYBACK_TYPE_ADS",E_:"PLAYBACK_TYPE_REMOTE",F_:"PLAYBACK_TYPE_SECONDARY_CAMERA",D_:"PLAYBACK_TYPE_PREROLL_INTERSTITIAL",C_:"PLAYBACK_TYPE_POSTROLL_INTERSTITIAL",B_:"PLAYBACK_TYPE_MIDROLL_INTERSTITIAL"};fn.prototype.set=function(a,b){b=void 0===b?!0:b;0<=a&&52>a&&0===a%1&&this.i[a]!=b&&(this.i[a]=b,this.l=-1)}; equals www.youtube.com (Youtube)
Source: base[1].js.2.dr	String found in binary or memory: g.k.getVideoUrl=function(a,b,c,d,e){b={list:b};c&&(e?b.time_continue=c:b.t=c);c=g.kD(this);d&&"www.youtube.com"===c?d="https://youtu.be/"+a:g.VC(this)?(d="https://"+c+"/fire",b.v=a):(d=this.protocol+"://"+c+"/watch",b.v=a,oq&&(a=zp())&&(b.ebc=a));return g.Id(d,b)}; equals www.youtube.com (Youtube)
Source: base[1].js.2.dr	String found in binary or memory: g.zD=function(a){var b=g.kD(a);!a.Z("yt_embeds_disable_new_error_lozenge_url")&&pha.includes(b)&&(b="www.youtube.com");return a.protocol+"://"+b}; equals www.youtube.com (Youtube)
Source: ~DF98A4ECC7A66069B4.TMP.1.dr	String found in binary or memory: https://m.facebook.com/login.php?next=https%3A%2F%2Fm.facebook.com%2Fsharer%2Fsharer.php%3Fu%26session_id%3Dc1cae970-247d-4b1b-bdcf-d7f53f40b341&refsrc=https%3A%2F%2Fwww.facebook.com%2Fsh equals www.facebook.com (Facebook)
Source: {2AFFB837-763F-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://m.facebook.com/login.php?next=https%3A%2F%2Fm.facebook.com%2Fsharer%2Fsharer.php%3Fu%26session_id%3Dc1cae970-247d-4b1b-bdcf-d7f53f40b341&refsrc=https%3A%2F%2Fwww.facebook.com%2Fsharer%2Fsharer.php&_rdr equals www.facebook.com (Facebook)
Source: {2AFFB837-763F-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://m.facebook.com/login.php?next=https%3A%2F%2Fm.facebook.com%2Fsharer%2Fsharer.php%3Fu%26session_id%3Dc1cae970-247d-4b1b-bdcf-d7f53f40b341&refsrc=https%3A%2F%2Fwww.facebook.com%2Fsharer%2Fsharer.php&_rdr8Log into Facebook \| Facebook equals www.facebook.com (Facebook)
Source: ~DF98A4ECC7A66069B4.TMP.1.dr	String found in binary or memory: https://m.facebook.com/login.php?next=https%3A%2F%2Fm.facebook.com%2Fsharer%2Fsharer.php%3Fu%26session_id%3Dc1cae970-247d-4b1b-bdcf-d7f53f40b341&refsrc=https%3A%2F%2Fwww.facebook.com%2Fsht equals www.facebook.com (Facebook)
Source: ~DF98A4ECC7A66069B4.TMP.1.dr	String found in binary or memory: https://twitter.com/share?url=?next=https%3A%2F%2Fm.facebook.com%2Fsharer%2Fsharer.php%3Fu%26session_id%3Dc1cae970-247d-4b1b-bdcf-d7f53f40b341&refsrc=https%3A%2F%2Fwww.facebook.com%2Fsharer%2Fsharer.php&_rdr equals www.facebook.com (Facebook)
Source: ~DF98A4ECC7A66069B4.TMP.1.dr	String found in binary or memory: https://twitter.com/share?url=?next=https%3A%2F%2Fm.facebook.com%2Fsharer%2Fsharer.php%3Fu%26session_id%3Dc1cae970-247d-4b1b-bdcf-d7f53f40b341&refsrc=https%3A%2F%2Fwww.facebook.com%2Fsharer%2Fsharer.php&_rdr equals www.twitter.com (Twitter)
Source: ~DF98A4ECC7A66069B4.TMP.1.dr	String found in binary or memory: https://twitter.com/share?url=?next=https%3A%2F%2Fm.facebook.com%2Fsharer%2Fsharer.php%3Fu%26session_id%3Dc1cae970-247d-4b1b-bdcf-d7f53f40b341&refsrc=https%3A%2F%2Fwww.facebook.com%2Fsharer%2Fsharer.php&_rdr.facebook.com/login.php?next=https%3A%2F%2Fm.facebook.com%2Fsharer%2Fsharer.php%3Fu%26session_id%3Dc1cae970-247d-4b1b-bdcf-d7f53f40b341&refsrc=https%3A%2F%2Fwww.facebook.com%2Fsharer%2Fsharer.php&_rdr equals www.facebook.com (Facebook)
Source: ~DF98A4ECC7A66069B4.TMP.1.dr	String found in binary or memory: https://twitter.com/share?url=?next=https%3A%2F%2Fm.facebook.com%2Fsharer%2Fsharer.php%3Fu%26session_id%3Dc1cae970-247d-4b1b-bdcf-d7f53f40b341&refsrc=https%3A%2F%2Fwww.facebook.com%2Fsharer%2Fsharer.php&_rdr.facebook.com/login.php?next=https%3A%2F%2Fm.facebook.com%2Fsharer%2Fsharer.php%3Fu%26session_id%3Dc1cae970-247d-4b1b-bdcf-d7f53f40b341&refsrc=https%3A%2F%2Fwww.facebook.com%2Fsharer%2Fsharer.php&_rdr equals www.twitter.com (Twitter)
Source: {2AFFB837-763F-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://www.facebook.com/theragcomp equals www.facebook.com (Facebook)
Source: {2AFFB837-763F-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://www.facebook.com/theragcompanyde/ equals www.facebook.com (Facebook)
Source: base[1].js.2.dr	String found in binary or memory: l,"Trusted Ad Domain URL");this.ga=T(!1,a.privembed);this.protocol=0===this.oc.indexOf("http:")?"http":"https";this.W=Sx((b?b.customBaseYoutubeUrl:a.BASE_YT_URL)\|\|"")\|\|Sx(this.oc)\|\|this.protocol+"://www.youtube.com/";l=b?b.eventLabel:a.el;h="detailpage";"adunit"===l?h=this.l?"embedded":"detailpage":"embedded"===l\|\|this.u?h=DC(h,l,mha):l&&(h="embedded");this.ea=h;wp();l=null;h=b?b.playerStyle:a.ps;var m=g.db(JC,h);!h\|\|m&&!this.u\|\|(l=h);this.playerStyle=l;this.J=(this.I=g.db(JC,this.playerStyle))&& equals www.youtube.com (Youtube)
Source: login[1].htm.2.dr	String found in binary or memory: s (Portugal)</a></span></div><div class="_3ztc"><span class="_52jc"><a href="/a/language.php?l=ar_AR&lref=https%3A%2F%2Fm.facebook.com%2Flogin.php%3Fnext%3Dhttps%253A%252F%252Fm.facebook.com%252Fsharer%252Fsharer.php%253Fu%2526session_id%253Dc1cae970-247d-4b1b-bdcf-d7f53f40b341%26refsrc%3Dhttps%253A%252F%252Fwww.facebook.com%252Fsharer%252Fsharer.php&sref=legacy_mobile_settings_selector&gfid=AQCp6fj9mkqMy8f-Rrc&refid=9" data-locale="ar_AR" data-sigil="change_language"> equals www.facebook.com (Facebook)
Source: base[1].js.2.dr	String found in binary or memory: this.V("highrepfallback");else if(a.i){var d=this.l?this.l.l.B:null;if(Tua(a)&&d&&d.isLocked())var e="FORMAT_UNAVAILABLE";else if(!this.i.I&&"auth"===a.errorCode&&"429"===a.details.rc){e="TOO_MANY_REQUESTS";var f="6"}this.V("playererror",a.errorCode,e,g.LA(a.details),f)}else d=/^pp/.test(this.videoData.clientPlaybackNonce),pU(this,a.errorCode,a.details),d&&"manifest.net.connect"===a.errorCode&&(d="https://www.youtube.com/generate_204?cpn="+this.videoData.clientPlaybackNonce+"&t="+(0,g.P)(),(new xT(d, equals www.youtube.com (Youtube)
Source: ~DF98A4ECC7A66069B4.TMP.1.dr	String found in binary or memory: tps://m.facebook.com/login.php?next=https%3A%2F%2Fm.facebook.com%2Fsharer%2Fsharer.php%3Fu%26session_id%3Dc1cae970-247d-4b1b-bdcf-d7f53f40b341&refsrc=https%3A%2F%2Fwww.facebook.com%2Fsharer%2Fsharer.php&_rdr equals www.facebook.com (Facebook)

Source: unknown

DNS traffic detected: queries for: theragcompany.de

Source: cart[1].htm.2.dr	String found in binary or memory: http://codepen.io/dimsemenov/pen/yyBWoR
Source: 1614093251-7ddc83436b566bc22bb74d9fc8f810c05c8b2daf.min[1].css.2.dr	String found in binary or memory: http://daneden.me/animate
Source: 6b3e3ddf6057[1].js.2.dr	String found in binary or memory: http://fb.me/use-check-prop-types
Source: vendors~main.b8f98575[1].js.2.dr	String found in binary or memory: http://git.io/TrdQbw
Source: marken[1].htm.2.dr, cart[1].htm.2.dr	String found in binary or memory: http://gmpg.org/xfn/11
Source: 1614093251-75a49f264d33bbcb6b5c66000065364281b29e75.min[1].css.2.dr	String found in binary or memory: http://go.wpbakery.com/licensing
Source: selectWoo.full.min[1].js.2.dr	String found in binary or memory: http://jquery.org/license
Source: rbtools.min[1].js.2.dr	String found in binary or memory: http://labs.rampinteractive.co.uk/touchSwipe/
Source: autoptimize_8c7c44f652932dec910e13d2649bf9eb[1].js.2.dr	String found in binary or memory: http://malsup.com/jquery/block/
Source: 1614093251-7ddc83436b566bc22bb74d9fc8f810c05c8b2daf.min[1].css.2.dr	String found in binary or memory: http://opensource.org/licenses/MIT
Source: rbtools.min[1].js.2.dr	String found in binary or memory: http://plugins.jquery.com/project/touchSwipe
Source: referenzen[1].htm.2.dr	String found in binary or memory: http://rdf.data-vocabulary.org/#
Source: d4c57d525e26[1].js.2.dr	String found in binary or memory: http://www.aboutads.info
Source: msapplication.xml.1.dr	String found in binary or memory: http://www.amazon.com/
Source: login[1].htm0.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: rbtools.min[1].js.2.dr	String found in binary or memory: http://www.github.com/mattbryson
Source: autoptimize_8c7c44f652932dec910e13d2649bf9eb[1].js.2.dr	String found in binary or memory: http://www.gnu.org/licenses/gpl.html
Source: msapplication.xml1.1.dr	String found in binary or memory: http://www.google.com/
Source: msapplication.xml2.1.dr	String found in binary or memory: http://www.live.com/
Source: d4c57d525e26[1].js.2.dr	String found in binary or memory: http://www.networkadvertising.org/managing/opt_out.asp
Source: msapplication.xml3.1.dr	String found in binary or memory: http://www.nytimes.com/
Source: autoptimize_8c7c44f652932dec910e13d2649bf9eb[1].js.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: msapplication.xml4.1.dr	String found in binary or memory: http://www.reddit.com/
Source: rs6[1].css.2.dr	String found in binary or memory: http://www.themepunch.com
Source: theragcompanyde[2].htm.2.dr	String found in binary or memory: http://www.theragcompany.de/
Source: msapplication.xml5.1.dr	String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.1.dr	String found in binary or memory: http://www.wikipedia.com/
Source: 5f29fc3b8e16[1].js.2.dr	String found in binary or memory: http://www.windowsphone.com/s?appid=3222a126-7f20-4273-ab4a-161120b21aea
Source: msapplication.xml7.1.dr	String found in binary or memory: http://www.youtube.com/
Source: base[1].js.2.dr	String found in binary or memory: http://www.youtube.com/videoplayback
Source: 6zO8wnqD4xU[1].htm.2.dr, sWLShHJm11w[1].htm.2.dr	String found in binary or memory: http://www.youtube.com/watch?v
Source: d4c57d525e26[1].js.2.dr	String found in binary or memory: http://youronlinechoices.eu
Source: base[1].js.2.dr	String found in binary or memory: http://youtube.com/drm/2012/10/10
Source: base[1].js.2.dr	String found in binary or memory: http://youtube.com/streaming/metadata/segment/102015
Source: base[1].js.2.dr	String found in binary or memory: http://youtube.com/streaming/otf/durations/112015
Source: base[1].js.2.dr	String found in binary or memory: http://youtube.com/yt/2012/10/10
Source: share[1].htm.2.dr	String found in binary or memory: https://abs.twimg.com/errors/logo46x38
Source: share[1].htm.2.dr	String found in binary or memory: https://abs.twimg.com/errors/logo46x38.png
Source: imagestore.dat.2.dr, ~DF98A4ECC7A66069B4.TMP.1.dr	String found in binary or memory: https://abs.twimg.com/favicons/twitter.ico
Source: share[1].htm.2.dr	String found in binary or memory: https://abs.twimg.com/responsive-web/client-web-legacy/i18n/en.089031c5.js
Source: share[1].htm.2.dr	String found in binary or memory: https://abs.twimg.com/responsive-web/client-web-legacy/icon-ios.b1fc7275.png
Source: share[1].htm.2.dr	String found in binary or memory: https://abs.twimg.com/responsive-web/client-web-legacy/icon-svg.168b89d5.svg
Source: share[1].htm.2.dr	String found in binary or memory: https://abs.twimg.com/responsive-web/client-web-legacy/main.189b0285.js
Source: share[1].htm.2.dr	String found in binary or memory: https://abs.twimg.com/responsive-web/client-web-legacy/polyfills.e0f21315.js
Source: share[1].htm.2.dr	String found in binary or memory: https://abs.twimg.com/responsive-web/client-web-legacy/vendors~main.b8f98575.js
Source: base[1].js.2.dr	String found in binary or memory: https://admin.youtube.com
Source: d4c57d525e26[1].js.2.dr	String found in binary or memory: https://api.instagram.com/oembed/?url=https://www.instagram.com/
Source: cart[1].htm.2.dr	String found in binary or memory: https://api.w.org/
Source: d4c57d525e26[1].js.2.dr	String found in binary or memory: https://applink.instagram.com
Source: share[1].htm.2.dr	String found in binary or memory: https://business.twitter.com/en/help/troubleshooting/how-twitter-ads-work.html
Source: 5f29fc3b8e16[1].js.2.dr	String found in binary or memory: https://connect.facebook.net/
Source: 5f29fc3b8e16[1].js.2.dr	String found in binary or memory: https://connect.facebook.net/en_US/sdk.js
Source: base[1].js.2.dr	String found in binary or memory: https://docs.google.com/get_video_info
Source: 6b3e3ddf6057[1].js.2.dr	String found in binary or memory: https://fb.me/react-polyfills
Source: bsuyEeCTvfm[1].js.2.dr	String found in binary or memory: https://fburl.com/debugjs.
Source: fa-regular-400[1].eot0.2.dr, 1614093251-75a49f264d33bbcb6b5c66000065364281b29e75.min[1].css.2.dr	String found in binary or memory: https://fontawesome.com
Source: 1614093251-75a49f264d33bbcb6b5c66000065364281b29e75.min[1].css.2.dr	String found in binary or memory: https://fontawesome.com/license/free
Source: fa-regular-400[1].eot0.2.dr, fa-brands-400[1].eot.2.dr, fa-solid-900[1].eot.2.dr	String found in binary or memory: https://fontawesome.comhttps://fontawesome.comFont
Source: 1614093251-7832dd33b8e5ebffaf4df30bd25f27e882c4a40c.min[1].css.2.dr, css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v17/S6u-w4BMUTPHjxsIPx-oPCQ.woff)
Source: 1614093251-7832dd33b8e5ebffaf4df30bd25f27e882c4a40c.min[1].css.2.dr, css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v17/S6u8w4BMUTPHh30AXC-s.woff)
Source: 1614093251-7832dd33b8e5ebffaf4df30bd25f27e882c4a40c.min[1].css.2.dr, css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v17/S6u8w4BMUTPHjxsAXC-s.woff)
Source: 1614093251-7832dd33b8e5ebffaf4df30bd25f27e882c4a40c.min[1].css.2.dr, css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v17/S6u9w4BMUTPHh50XSwiPHw.woff)
Source: 1614093251-7832dd33b8e5ebffaf4df30bd25f27e882c4a40c.min[1].css.2.dr, css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v17/S6u9w4BMUTPHh6UVSwiPHw.woff)
Source: 1614093251-7832dd33b8e5ebffaf4df30bd25f27e882c4a40c.min[1].css.2.dr, css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v17/S6u9w4BMUTPHh7USSwiPHw.woff)
Source: 1614093251-7832dd33b8e5ebffaf4df30bd25f27e882c4a40c.min[1].css.2.dr, css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v17/S6u_w4BMUTPHjxsI3wi_Gwfr.woff)
Source: 1614093251-7832dd33b8e5ebffaf4df30bd25f27e882c4a40c.min[1].css.2.dr, css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v17/S6u_w4BMUTPHjxsI5wq_Gwfr.woff)
Source: 1614093251-7832dd33b8e5ebffaf4df30bd25f27e882c4a40c.min[1].css.2.dr, css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v17/S6u_w4BMUTPHjxsI9w2_Gwfr.woff)
Source: 1614093251-7832dd33b8e5ebffaf4df30bd25f27e882c4a40c.min[1].css.2.dr, css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v17/S6uyw4BMUTPHjx4wWA.woff)
Source: 1614093251-7832dd33b8e5ebffaf4df30bd25f27e882c4a40c.min[1].css.2.dr, css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOiCnqEu92Fr1Mu51QrEzAdKQ.woff)
Source: 1614093251-7832dd33b8e5ebffaf4df30bd25f27e882c4a40c.min[1].css.2.dr, css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOjCnqEu92Fr1Mu51S7ACc6CsI.woff)
Source: 1614093251-7832dd33b8e5ebffaf4df30bd25f27e882c4a40c.min[1].css.2.dr, css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOjCnqEu92Fr1Mu51TLBCc6CsI.woff)
Source: 1614093251-7832dd33b8e5ebffaf4df30bd25f27e882c4a40c.min[1].css.2.dr, css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOjCnqEu92Fr1Mu51TjASc6CsI.woff)
Source: 1614093251-7832dd33b8e5ebffaf4df30bd25f27e882c4a40c.min[1].css.2.dr, css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOjCnqEu92Fr1Mu51TzBic6CsI.woff)
Source: 1614093251-7832dd33b8e5ebffaf4df30bd25f27e882c4a40c.min[1].css.2.dr, css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOkCnqEu92Fr1MmgVxIIzQ.woff)
Source: 1614093251-7832dd33b8e5ebffaf4df30bd25f27e882c4a40c.min[1].css.2.dr, css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOkCnqEu92Fr1Mu51xIIzQ.woff)
Source: 1614093251-7832dd33b8e5ebffaf4df30bd25f27e882c4a40c.min[1].css.2.dr, css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc-.woff)
Source: 1614093251-7832dd33b8e5ebffaf4df30bd25f27e882c4a40c.min[1].css.2.dr, css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmSU5fBBc-.woff)
Source: 1614093251-7832dd33b8e5ebffaf4df30bd25f27e882c4a40c.min[1].css.2.dr, css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc-.woff)
Source: 1614093251-7832dd33b8e5ebffaf4df30bd25f27e882c4a40c.min[1].css.2.dr, css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmYUtfBBc-.woff)
Source: 1614093251-7832dd33b8e5ebffaf4df30bd25f27e882c4a40c.min[1].css.2.dr, css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxM.woff)
Source: 1614093251-75a49f264d33bbcb6b5c66000065364281b29e75.min[1].css.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: autoptimize_8c7c44f652932dec910e13d2649bf9eb[1].js.2.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: rbtools.min[1].js.2.dr	String found in binary or memory: https://github.com/mattbryson/TouchSwipe-Jquery-Plugin
Source: 1614093251-75a49f264d33bbcb6b5c66000065364281b29e75.min[1].css.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: selectWoo.full.min[1].js.2.dr	String found in binary or memory: https://github.com/woocommerce/selectWoo
Source: selectWoo.full.min[1].js.2.dr	String found in binary or memory: https://github.com/woocommerce/selectWoo/blob/master/LICENSE.md
Source: 5f29fc3b8e16[1].js.2.dr	String found in binary or memory: https://graph.instagram.com/logging_client_events
Source: rbtools.min[1].js.2.dr	String found in binary or memory: https://greensock.com
Source: rbtools.min[1].js.2.dr	String found in binary or memory: https://greensock.com/standard-license
Source: d4c57d525e26[1].js.2.dr	String found in binary or memory: https://help.instagram.com/1006568999411025
Source: d4c57d525e26[1].js.2.dr	String found in binary or memory: https://help.instagram.com/1009785806132609
Source: 58fb5608d564[1].js.2.dr	String found in binary or memory: https://help.instagram.com/155833707900388
Source: d4c57d525e26[1].js.2.dr	String found in binary or memory: https://help.instagram.com/1731078377046291
Source: 5f29fc3b8e16[1].js.2.dr	String found in binary or memory: https://help.instagram.com/176296189679904?ref=tos
Source: share[1].htm.2.dr	String found in binary or memory: https://help.twitter.com/using-twitter/twitter-supported-browsers
Source: 5f29fc3b8e16[1].js.2.dr	String found in binary or memory: https://i.instagram.com
Source: 5f29fc3b8e16[1].js.2.dr	String found in binary or memory: https://i.instagram.com/api/
Source: 576CxG2WOtZkEJJea5OpjQ[1].htm.2.dr	String found in binary or memory: https://i.scdn.co/image/e7db7207451007945abf2e67c766ae7b089e71c7);background-size:cover;background-r
Source: 6zO8wnqD4xU[1].htm.2.dr	String found in binary or memory: https://i.ytimg.com/vi/6zO8wnqD4xU/default.jpg
Source: 6zO8wnqD4xU[1].htm.2.dr	String found in binary or memory: https://i.ytimg.com/vi/6zO8wnqD4xU/hqdefault.jpg
Source: 6zO8wnqD4xU[1].htm.2.dr	String found in binary or memory: https://i.ytimg.com/vi/6zO8wnqD4xU/hqdefault.jpg?sqp
Source: 6zO8wnqD4xU[1].htm.2.dr	String found in binary or memory: https://i.ytimg.com/vi/6zO8wnqD4xU/mqdefault.jpg
Source: sWLShHJm11w[1].htm.2.dr	String found in binary or memory: https://i.ytimg.com/vi/sWLShHJm11w/default.jpg
Source: sWLShHJm11w[1].htm.2.dr	String found in binary or memory: https://i.ytimg.com/vi/sWLShHJm11w/hqdefault.jpg
Source: sWLShHJm11w[1].htm.2.dr	String found in binary or memory: https://i.ytimg.com/vi/sWLShHJm11w/hqdefault.jpg?sqp
Source: sWLShHJm11w[1].htm.2.dr	String found in binary or memory: https://i.ytimg.com/vi/sWLShHJm11w/maxresdefault.jpg
Source: sWLShHJm11w[1].htm.2.dr	String found in binary or memory: https://i.ytimg.com/vi/sWLShHJm11w/mqdefault.jpg
Source: sWLShHJm11w[1].htm.2.dr	String found in binary or memory: https://i.ytimg.com/vi/sWLShHJm11w/sddefault.jpg
Source: isotope.pkgd.min[1].js.2.dr	String found in binary or memory: https://isotope.metafizzy.co
Source: 5f29fc3b8e16[1].js.2.dr	String found in binary or memory: https://itunes.apple.com/app/igtv/id1394351700
Source: 5f29fc3b8e16[1].js.2.dr	String found in binary or memory: https://itunes.apple.com/app/instagram/id389801252
Source: share[1].htm.2.dr	String found in binary or memory: https://legal.twitter.com/imprint
Source: marken[1].htm.2.dr, cart[1].htm.2.dr, LETOMXZM.htm.2.dr	String found in binary or memory: https://ogp.me/ns#
Source: base[1].js.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/osd.js
Source: 5f29fc3b8e16[1].js.2.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=com.instagram.android
Source: 5f29fc3b8e16[1].js.2.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=com.instagram.igtv
Source: RpTFjVvO4D0[1].js.2.dr	String found in binary or memory: https://scontent.xx.fbcdn.net/hads-ak-prn2/1487645_6012475414660_1439393861_n.png
Source: theragcompanyde[2].htm.2.dr	String found in binary or memory: https://static.xx.fbcdn.net/rsrc.php/v3/y5/r/ZWx4MakmUd4.png
Source: login[1].htm.2.dr	String found in binary or memory: https://static.xx.fbcdn.net/rsrc.php/v3/y9/l/0
Source: login[1].htm.2.dr, theragcompanyde[2].htm.2.dr	String found in binary or memory: https://static.xx.fbcdn.net/rsrc.php/v3/y9/r/TgvtWu7yqq9.js?_nc_x=Ij3Wp8lg5Kz
Source: theragcompanyde[2].htm.2.dr	String found in binary or memory: https://static.xx.fbcdn.net/rsrc.php/v3/yD/r/qvZe07446FL.png
Source: theragcompanyde[2].htm.2.dr	String found in binary or memory: https://static.xx.fbcdn.net/rsrc.php/v3/yF/r/pyYQnfyFuM4.js?_nc_x=Ij3Wp8lg5Kz
Source: login[1].htm.2.dr	String found in binary or memory: https://static.xx.fbcdn.net/rsrc.php/v3/yH/l/0
Source: login[1].htm.2.dr	String found in binary or memory: https://static.xx.fbcdn.net/rsrc.php/v3/yL/l/0
Source: theragcompanyde[2].htm.2.dr	String found in binary or memory: https://static.xx.fbcdn.net/rsrc.php/v3/yL/r/OOZ5Mnw2bdX.js?_nc_x=Ij3Wp8lg5Kz
Source: login[1].htm.2.dr	String found in binary or memory: https://static.xx.fbcdn.net/rsrc.php/v3/yT/l/0
Source: theragcompanyde[2].htm.2.dr	String found in binary or memory: https://static.xx.fbcdn.net/rsrc.php/v3/yV/r/c-IOC1UqHiT.png
Source: theragcompanyde[2].htm.2.dr	String found in binary or memory: https://static.xx.fbcdn.net/rsrc.php/v3/yY/l/0
Source: theragcompanyde[2].htm.2.dr	String found in binary or memory: https://static.xx.fbcdn.net/rsrc.php/v3/yY/r/XdCkRE_yh9l.js?_nc_x=Ij3Wp8lg5Kz
Source: theragcompanyde[2].htm.2.dr	String found in binary or memory: https://static.xx.fbcdn.net/rsrc.php/v3/yY/r/ZtlJBzHe2b5.js?_nc_x=Ij3Wp8lg5Kz
Source: theragcompanyde[2].htm.2.dr	String found in binary or memory: https://static.xx.fbcdn.net/rsrc.php/v3/y_/r/6iW1q19tush.js?_nc_x=Ij3Wp8lg5Kz
Source: imagestore.dat.2.dr, ~DF98A4ECC7A66069B4.TMP.1.dr	String found in binary or memory: https://static.xx.fbcdn.net/rsrc.php/v3/ya/r/O2aKM2iSbOw.png
Source: theragcompanyde[2].htm.2.dr	String found in binary or memory: https://static.xx.fbcdn.net/rsrc.php/v3/ye/r/_iGs50jDGbv.png
Source: theragcompanyde[2].htm.2.dr	String found in binary or memory: https://static.xx.fbcdn.net/rsrc.php/v3/yg/l/0
Source: theragcompanyde[2].htm.2.dr	String found in binary or memory: https://static.xx.fbcdn.net/rsrc.php/v3/yg/r/WJqYlJL7tRX.js?_nc_x=Ij3Wp8lg5Kz
Source: login[1].htm.2.dr, theragcompanyde[2].htm.2.dr	String found in binary or memory: https://static.xx.fbcdn.net/rsrc.php/v3/yh/r/VYBZ5aQNl5L.js?_nc_x=Ij3Wp8lg5Kz
Source: login[1].htm.2.dr	String found in binary or memory: https://static.xx.fbcdn.net/rsrc.php/v3/yi/l/0
Source: login[1].htm.2.dr, theragcompanyde[2].htm.2.dr	String found in binary or memory: https://static.xx.fbcdn.net/rsrc.php/v3/yk/r/rGp_nwIzNeI.js?_nc_x=Ij3Wp8lg5Kz
Source: theragcompanyde[2].htm.2.dr	String found in binary or memory: https://static.xx.fbcdn.net/rsrc.php/v3/yl/r/7wycyFqCurV.png
Source: login[1].htm.2.dr, theragcompanyde[2].htm.2.dr	String found in binary or memory: https://static.xx.fbcdn.net/rsrc.php/v3/yl/r/dABzLpfYcr-.js?_nc_x=Ij3Wp8lg5Kz
Source: login[1].htm.2.dr, theragcompanyde[2].htm.2.dr	String found in binary or memory: https://static.xx.fbcdn.net/rsrc.php/v3/ym/r/SxgHfh5i5IF.js?_nc_x=Ij3Wp8lg5Kz
Source: theragcompanyde[2].htm.2.dr	String found in binary or memory: https://static.xx.fbcdn.net/rsrc.php/v3/ym/r/WVUaFQ5W2MS.js?_nc_x=Ij3Wp8lg5Kz
Source: theragcompanyde[2].htm.2.dr	String found in binary or memory: https://static.xx.fbcdn.net/rsrc.php/v3/yo/r/8uhwfRjdcy8.png
Source: login[1].htm.2.dr	String found in binary or memory: https://static.xx.fbcdn.net/rsrc.php/v3/yt/l/0
Source: theragcompanyde[2].htm.2.dr	String found in binary or memory: https://static.xx.fbcdn.net/rsrc.php/v3/yt/r/GWGxn_Tx65X.png
Source: login[1].htm.2.dr, theragcompanyde[2].htm.2.dr	String found in binary or memory: https://static.xx.fbcdn.net/rsrc.php/v3iK-b4/y1/l/en_US/xqAIYPXCpKB.js?_nc_x=Ij3Wp8lg5Kz
Source: d4c57d525e26[1].js.2.dr	String found in binary or memory: https://support.google.com/chrome/answer/95647
Source: base[1].js.2.dr	String found in binary or memory: https://support.google.com/youtube/?p=missing_quality
Source: base[1].js.2.dr	String found in binary or memory: https://support.google.com/youtube/?p=noaudio
Source: base[1].js.2.dr	String found in binary or memory: https://support.google.com/youtube/?p=report_playback
Source: base[1].js.2.dr	String found in binary or memory: https://support.google.com/youtube/answer/6276924
Source: remote[1].js.2.dr	String found in binary or memory: https://support.google.com/youtube/answer/7640706
Source: share[1].htm.2.dr	String found in binary or memory: https://support.twitter.com/articles/20170514
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/?p=11
Source: {2AFFB837-763F-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://theragcompany.de/ZThe
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/account/
Source: marken[1].htm.2.dr, business-program[1].htm.2.dr, referenzen[1].htm.2.dr, cart[1].htm.2.dr, LETOMXZM.htm.2.dr, shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/account/?action=register
Source: marken[1].htm.2.dr, business-program[1].htm.2.dr, referenzen[1].htm.2.dr, cart[1].htm.2.dr, LETOMXZM.htm.2.dr, shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/account/lost-password/
Source: ~DF98A4ECC7A66069B4.TMP.1.dr	String found in binary or memory: https://theragcompany.de/accounts/login/?next=/theragcompanyde/
Source: ~DF98A4ECC7A66069B4.TMP.1.dr	String found in binary or memory: https://theragcompany.de/accounts/login/?next=/theragcompanyde/T
Source: ~DF98A4ECC7A66069B4.TMP.1.dr	String found in binary or memory: https://theragcompany.de/art/
Source: ~DF98A4ECC7A66069B4.TMP.1.dr	String found in binary or memory: https://theragcompany.de/art/cropped-TheRagCompanyFavicon-300x300.png
Source: ~DF98A4ECC7A66069B4.TMP.1.dr	String found in binary or memory: https://theragcompany.de/art/pany.de/wp-content/uploads/2020/01/cropped-TheRagCompanyFavicon-100x100
Source: {2AFFB837-763F-11EB-90E4-ECF4BB862DED}.dat.1.dr, LETOMXZM.htm.2.dr, shop[1].htm.2.dr, ~DF98A4ECC7A66069B4.TMP.1.dr	String found in binary or memory: https://theragcompany.de/business-program/
Source: {2AFFB837-763F-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://theragcompany.de/business-program/DBusiness
Source: ~DF98A4ECC7A66069B4.TMP.1.dr	String found in binary or memory: https://theragcompany.de/business-program/v
Source: {2AFFB837-763F-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://theragcompany.de/cart/
Source: ~DF98A4ECC7A66069B4.TMP.1.dr	String found in binary or memory: https://theragcompany.de/cart/6Warenkorb
Source: ~DF98A4ECC7A66069B4.TMP.1.dr	String found in binary or memory: https://theragcompany.de/cart/ts/login/?next=/theragcompanyde/
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/checkout/
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/comments/feed/
Source: cart[1].htm.2.dr, LETOMXZM.htm.2.dr, shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/contact/
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/feed/
Source: {2AFFB837-763F-11EB-90E4-ECF4BB862DED}.dat.1.dr, LETOMXZM.htm.2.dr, shop[1].htm.2.dr, ~DF98A4ECC7A66069B4.TMP.1.dr	String found in binary or memory: https://theragcompany.de/marken/
Source: {2AFFB837-763F-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://theragcompany.de/marken/0Brands
Source: ~DF98A4ECC7A66069B4.TMP.1.dr	String found in binary or memory: https://theragcompany.de/marken/b
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/bestseller/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/fahrzeugwasche/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/fahrzeugwasche/dekontamination/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/fahrzeugwasche/felgenreinigung-pflege/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/fahrzeugwasche/kits-bundles/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/fahrzeugwasche/motorraum/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/fahrzeugwasche/rinseless-waterless-wasche/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/fahrzeugwasche/scheiben/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/fahrzeugwasche/spruhversiegelung-detailer/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/fahrzeugwasche/trockentuecher/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/fahrzeugwasche/waschhandschuhe-waschpads/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/fahrzeugwasche/zubehor-fahrzeugwasche/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/hersteller-marken/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/hersteller-marken/detail-factory/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/hersteller-marken/ik-sprayer/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/hersteller-marken/koch-chemie/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/hersteller-marken/kxk-dynamics/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/hersteller-marken/optimum/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/hersteller-marken/ps/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/hersteller-marken/trc/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/hersteller-marken/wheel-woolies/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/innenraum/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/innenraum/leder/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/innenraum/pflegesets/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/innenraum/reinigung-pflege/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/innenraum/scheibenreinigung/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/innenraum/textilien-polster/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/innenraum/zubehor-innenraum/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/keine-kategorie/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/merchandise/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/neuheiten/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/polieren/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/sparpakete/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/sparpakete/kits-sets/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/sparpakete/sparpakete-sparpakete/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/sparpakete/testpakete/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/versiegelung-wachs/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/versiegelung-wachs/detailer-spruehversiegelungen/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/versiegelung-wachs/versiegelungsprodukte/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product-categorie/zubehor-versiegelung-wachs/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product/detail-factory-boars-hair-detailing-pinsel-2tlg/
Source: LETOMXZM.htm.2.dr	String found in binary or memory: https://theragcompany.de/product/detail-factory-boars-hair-detailing-pinsel/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product/goizper-ik-foam-pro-12-druckpumpspruher/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product/goizper-ik-foam-pro-2-schaumspruher/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product/goizper-ik-multi-pro-12-druckpumpsprueher/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product/goizper-ik-multi-pro-2-druckpumpspruher/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/product/goizper-ik-multi-tr1-spruhflasche/
Source: LETOMXZM.htm.2.dr	String found in binary or memory: https://theragcompany.de/product/the-rag-company-ultra-clay-bar-200g/
Source: cart[1].htm.2.dr, LETOMXZM.htm.2.dr, shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/referenzen/
Source: ~DF98A4ECC7A66069B4.TMP.1.dr	String found in binary or memory: https://theragcompany.de/referenzen/ram/
Source: ~DF98A4ECC7A66069B4.TMP.1.dr	String found in binary or memory: https://theragcompany.de/shaming.php
Source: {2AFFB837-763F-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://theragcompany.de/shaming.phpLSeite
Source: {2AFFB837-763F-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://theragcompany.de/shaming.phpRoot
Source: {2AFFB837-763F-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://theragcompany.de/shaming.phpj
Source: shop[1].htm.2.dr, ~DF98A4ECC7A66069B4.TMP.1.dr	String found in binary or memory: https://theragcompany.de/shop/
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/shop/page/2/
Source: cart[1].htm.2.dr, LETOMXZM.htm.2.dr, shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/uber-uns/
Source: cart[1].htm.2.dr, LETOMXZM.htm.2.dr, shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/waschanleitung/
Source: 1614093251-659e348ab24718417fde23b331651e780dfd8a3c.footer.min[1].js.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/cache/autoptimize/js/autoptimize_8c7c44f652932dec910e13d2649bf9e
Source: marken[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/cache/fvm/min/theragcompany.de/1614093251-027418079d546f131c069a
Source: marken[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/cache/fvm/min/theragcompany.de/1614093251-659e348ab24718417fde23
Source: shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/cache/fvm/min/theragcompany.de/1614093251-75a49f264d33bbcb6b5c66
Source: business-program[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/cache/fvm/min/theragcompany.de/1614093251-7d953cc3f6c9a580aecde7
Source: LETOMXZM.htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/cache/fvm/min/theragcompany.de/1614093251-7ddc83436b566bc22bb74d
Source: referenzen[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/cache/fvm/min/theragcompany.de/1614093251-ccdf912b15e03c1aff4e7d
Source: marken[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/cache/fvm/min/theragcompany.de/1614093251-f580518998530f1d8d2ed3
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/plugins/js_composer/assets/css/js_composer.min.css?ver=6.6.0
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/plugins/js_composer/assets/js/dist/js_composer_front.min.js?ver=
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/plugins/js_composer/assets/js/vendors/woocommerce-add-to-cart.js
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/plugins/js_composer/assets/lib/bower/font-awesome/css/all.min.cs
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/plugins/js_composer/assets/lib/bower/font-awesome/css/v4-shims.m
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/plugins/js_composer/assets/lib/bower/isotope/dist/isotope.pkgd.m
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/plugins/revslider/public/assets/css/rs6.css?ver=6.3.9
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/plugins/revslider/public/assets/js/rbtools.min.js?ver=6.3.9
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/plugins/revslider/public/assets/js/rs6.min.js?ver=6.3.9
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/plugins/woocommerce-germanized/assets/css/layout.min.css?ver=3.3
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/plugins/woocommerce/assets/css/select2.css?ver=5.0.0
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart-variation.min
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js?ver=5.
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/plugins/woocommerce/assets/js/frontend/address-i18n.min.js?ver=5
Source: marken[1].htm.2.dr, cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/plugins/woocommerce/assets/js/frontend/cart-fragments.min.js
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/plugins/woocommerce/assets/js/frontend/cart.min.js?ver=5.0.0
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/plugins/woocommerce/assets/js/frontend/country-select.min.js?ver
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/plugins/woocommerce/assets/js/frontend/woocommerce.min.js?ver=5.
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/plugins/woocommerce/assets/js/jquery-blockui/jquery.blockUI.min.
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/plugins/woocommerce/assets/js/js-cookie/js.cookie.min.js?ver=2.1
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/plugins/woocommerce/assets/js/selectWoo/selectWoo.full.min.js?ve
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/style.css?
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/plugins/woocommerce/packages/woocommerce-blocks/build/vendors-st
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/themes/woodmart/css/bootstrap.min.css?ver=5.3.6
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/themes/woodmart/js/theme.min.js?ver=5.3.6
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/themes/woodmart/style.min.css?ver=5.3.6
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/uploads/2020/01/TRC-banner-website.png
Source: imagestore.dat.1.dr, marken[1].htm.2.dr, ~DF98A4ECC7A66069B4.TMP.1.dr	String found in binary or memory: https://theragcompany.de/wp-content/uploads/2020/01/cropped-TheRagCompanyFavicon-100x100.png
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/uploads/2020/01/cropped-TheRagCompanyFavicon-300x300.png
Source: referenzen[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/uploads/2020/05/Autolack-Affen-350x350.png
Source: referenzen[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/uploads/2020/05/GlossBoss-800x600.png
Source: marken[1].htm.2.dr, cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/uploads/2021/02/Vorkasse-Logo-e1613587708182.png
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-content/uploads/2021/02/xts-theme_settings_default-1614093299.css?ver=5.
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-includes/css/dist/block-library/style.min.css?ver=5.6.2
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-includes/js/imagesloaded.min.js?ver=4.1.4
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Source: 1614093251-f580518998530f1d8d2ed3462d0117e998311045.header.min[1].js.2.dr	String found in binary or memory: https://theragcompany.de/wp-includes/js/jquery/jquery.min.js
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-includes/js/jquery/jquery.min.js?ver=3.5.1
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-includes/js/underscore.min.js?ver=1.8.3
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-includes/js/wp-embed.min.js?ver=5.6.2
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-includes/js/wp-util.min.js?ver=5.6.2
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-includes/wlwmanifest.xml
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-json/
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-json/oembed/1.0/embed?url=https%3A%2F%2Ftheragcompany.de%2Fcart%2F
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-json/oembed/1.0/embed?url=https%3A%2F%2Ftheragcompany.de%2Fcart%2F&
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-json/wp/v2/pages/11
Source: marken[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-json/wp/v2/pages/1681
Source: referenzen[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-json/wp/v2/pages/1683
Source: LETOMXZM.htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-json/wp/v2/pages/18
Source: business-program[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wp-json/wp/v2/pages/1876
Source: marken[1].htm.2.dr, business-program[1].htm.2.dr, referenzen[1].htm.2.dr, cart[1].htm.2.dr, LETOMXZM.htm.2.dr, shop[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/wunschzettel/
Source: marken[1].htm.2.dr, cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/xmlrpc.php
Source: cart[1].htm.2.dr	String found in binary or memory: https://theragcompany.de/xmlrpc.php?rsd
Source: en.089031c5[1].js.2.dr	String found in binary or memory: https://ton.twitter.com/responsive-web-internal/sourcemaps/client-web-legacy/en.089031c5.js.map
Source: main.189b0285[1].js.2.dr	String found in binary or memory: https://ton.twitter.com/responsive-web-internal/sourcemaps/client-web-legacy/main.189b0285.js.map
Source: ondemand.Dropdown.c3a8c6a5[1].js.2.dr	String found in binary or memory: https://ton.twitter.com/responsive-web-internal/sourcemaps/client-web-legacy/ondemand.Dropdown.c3a8c
Source: polyfills.e0f21315[1].js.2.dr	String found in binary or memory: https://ton.twitter.com/responsive-web-internal/sourcemaps/client-web-legacy/polyfills.e0f21315.js.m
Source: vendors~main.b8f98575[1].js.2.dr	String found in binary or memory: https://ton.twitter.com/responsive-web-internal/sourcemaps/client-web-legacy/vendors~main.b8f98575.j
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/privacy
Source: {2AFFB837-763F-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://twitter.com/sh
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=ar
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=bg
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=bn
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=ca
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=cs
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=da
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=de
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=el
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=en
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=en-GB
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=en-ss
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=en-xx
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=es
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=eu
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=fa
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=fi
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=fil
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=fr
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=ga
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=gl
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=gu
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=he
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=hi
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=hr
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=hu
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=id
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=it
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=ja
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=kn
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=ko
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=mr
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=ms
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=nb
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=nl
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=pl
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=pt
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=ro
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=ru
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=sk
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=sr
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=sv
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=ta
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=th
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=tr
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=uk
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=ur
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=vi
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=zh
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?lang=zh-Hant
Source: {2AFFB837-763F-11EB-90E4-ECF4BB862DED}.dat.1.dr, ~DF98A4ECC7A66069B4.TMP.1.dr	String found in binary or memory: https://twitter.com/share?url=
Source: cart[1].htm.2.dr	String found in binary or memory: https://twitter.com/share?url=https://theragcompany.de/cart/
Source: share[1].htm.2.dr	String found in binary or memory: https://twitter.com/tos
Source: rs6[1].css.2.dr	String found in binary or memory: https://una.im/CSSgram/
Source: base[1].js.2.dr	String found in binary or memory: https://viacon.corp.google.com
Source: cart[1].htm.2.dr	String found in binary or memory: https://wpaffiliatemanager.com/
Source: 1614093251-75a49f264d33bbcb6b5c66000065364281b29e75.min[1].css.2.dr	String found in binary or memory: https://wpbakery.com)
Source: cart[1].htm.2.dr	String found in binary or memory: https://wprediscache.com
Source: marken[1].htm.2.dr	String found in binary or memory: https://www.boldgrid.com/w3-total-cache/
Source: {2AFFB837-763F-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://www.facebook.c
Source: {2AFFB837-763F-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://www.facebook.cde/shaming.phpj
Source: d4c57d525e26[1].js.2.dr	String found in binary or memory: https://www.fbsbx.com/captcha/recaptcha/iframe/
Source: base[1].js.2.dr	String found in binary or memory: https://www.googleapis.com/certificateprovisioning/v1/devicecertificates/create?key=AIzaSyB-5OLKTx2i
Source: remote[1].js.2.dr	String found in binary or memory: https://www.gstatic.com/cv/js/sender/v1/cast_sender.js
Source: {2AFFB837-763F-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://www.instagram.
Source: 5f29fc3b8e16[1].js.2.dr	String found in binary or memory: https://www.instagram.com
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/
Source: {2AFFB837-763F-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/therRoot
Source: {2AFFB837-763F-11EB-90E4-ECF4BB862DED}.dat.1.dr, ~DF98A4ECC7A66069B4.TMP.1.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=af
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=bg
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=bn
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=cs
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=da
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=de
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=el
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=en
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=en-gb
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=es
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=es-la
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=fi
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=fr
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=fr-ca
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=gu
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=hi
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=hr
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=hu
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=id
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=it
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=ja
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=kn
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=ko
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=ml
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=mr
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=ms
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=nb
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=ne
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=nl
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=pa
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=pl
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=pt
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=pt-br
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=ro
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=ru
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=si
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=sk
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=sr
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=sv
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=ta
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=te
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=th
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=tl
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=tr
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=uk
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=ur
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=vi
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=zh-cn
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=zh-hk
Source: login[1].htm0.2.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=zh-tw
Source: ~DF98A4ECC7A66069B4.TMP.1.dr	String found in binary or memory: https://www.instagram.com/accounts/login/?next=/theragcompanyde/S
Source: d4c57d525e26[1].js.2.dr	String found in binary or memory: https://www.instagram.com/browser/closeWindow
Source: imagestore.dat.2.dr, ~DF98A4ECC7A66069B4.TMP.1.dr	String found in binary or memory: https://www.instagram.com/static/images/ico/favicon-192.png/68d99ba29cc8.png
Source: cart[1].htm.2.dr	String found in binary or memory: https://www.instagram.com/theragcompanyde/
Source: bsuyEeCTvfm[1].js.2.dr	String found in binary or memory: https://www.internalfb.com/intern/invariant/
Source: autoptimize_8c7c44f652932dec910e13d2649bf9eb[1].js.2.dr	String found in binary or memory: https://www.themepunch.com/links/slider_revolution_wordpress_regular_license
Source: autoptimize_8c7c44f652932dec910e13d2649bf9eb[1].js.2.dr	String found in binary or memory: https://www.themepunch.com/support-center
Source: business-program[1].htm.2.dr, cart[1].htm.2.dr	String found in binary or memory: https://www.theragcompany.de/agb/
Source: marken[1].htm.2.dr, cart[1].htm.2.dr	String found in binary or memory: https://www.theragcompany.de/contact/
Source: business-program[1].htm.2.dr, cart[1].htm.2.dr	String found in binary or memory: https://www.theragcompany.de/datenschutz/
Source: business-program[1].htm.2.dr, cart[1].htm.2.dr	String found in binary or memory: https://www.theragcompany.de/wiederrufsbelehrung/
Source: marken[1].htm.2.dr, cart[1].htm.2.dr	String found in binary or memory: https://www.theragcompany.de/wp-content/uploads/2020/06/DHL-Logo-e1595003749295.png
Source: marken[1].htm.2.dr, cart[1].htm.2.dr	String found in binary or memory: https://www.theragcompany.de/wp-content/uploads/2020/06/PayPal-Logo-e1595003724191.png
Source: cart[1].htm.2.dr	String found in binary or memory: https://www.theragcompany.de/zahlung-versand/
Source: referenzen[1].htm.2.dr	String found in binary or memory: https://www.youtube.com/embed/sWLShHJm11w?feature=oembed
Source: base[1].js.2.dr	String found in binary or memory: https://www.youtube.com/generate_204?cpn=
Source: base[1].js.2.dr	String found in binary or memory: https://youtu.be/
Source: 6zO8wnqD4xU[1].htm.2.dr	String found in binary or memory: https://youtu.be/6zO8wnqD4xU
Source: sWLShHJm11w[1].htm.2.dr	String found in binary or memory: https://youtu.be/sWLShHJm11w
Source: base[1].js.2.dr	String found in binary or memory: https://youtube.com/api/drm/fps?ek=uninitialized
Source: base[1].js.2.dr	String found in binary or memory: https://youtubei.googleapis.com/youtubei/
Source: 6zO8wnqD4xU[1].htm.2.dr	String found in binary or memory: https://yt3.ggpht.com/ytc/AAUvwngo19gSijepEhTK4ZC0Irmb_t8hy61MvTuRRxu9Eg
Source: sWLShHJm11w[1].htm.2.dr	String found in binary or memory: https://yt3.ggpht.com/ytc/AAUvwniNYzaMpMafV54FH59r81TxMbOGHlY9q3lRTMpS
Source: base[1].js.2.dr	String found in binary or memory: https://yurt.corp.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 185.104.28.118:443 -> 192.168.2.3:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.104.28.118:443 -> 192.168.2.3:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.104.28.118:443 -> 192.168.2.3:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.104.28.118:443 -> 192.168.2.3:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.104.28.118:443 -> 192.168.2.3:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.36:443 -> 192.168.2.3:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.36:443 -> 192.168.2.3:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.36:443 -> 192.168.2.3:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.36:443 -> 192.168.2.3:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.27.27:443 -> 192.168.2.3:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.27.27:443 -> 192.168.2.3:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.27.27:443 -> 192.168.2.3:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.27.27:443 -> 192.168.2.3:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.27.27:443 -> 192.168.2.3:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.27.27:443 -> 192.168.2.3:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.36:443 -> 192.168.2.3:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.36:443 -> 192.168.2.3:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.36:443 -> 192.168.2.3:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.36:443 -> 192.168.2.3:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.36:443 -> 192.168.2.3:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.36:443 -> 192.168.2.3:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.14:443 -> 192.168.2.3:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.14:443 -> 192.168.2.3:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.244.42.193:443 -> 192.168.2.3:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.244.42.193:443 -> 192.168.2.3:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.141:443 -> 192.168.2.3:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.141:443 -> 192.168.2.3:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.141:443 -> 192.168.2.3:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.141:443 -> 192.168.2.3:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.60.216.19:443 -> 192.168.2.3:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.60.216.19:443 -> 192.168.2.3:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.20.19:443 -> 192.168.2.3:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.20.19:443 -> 192.168.2.3:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.20.19:443 -> 192.168.2.3:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.20.19:443 -> 192.168.2.3:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.174:443 -> 192.168.2.3:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.174:443 -> 192.168.2.3:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.186.224.25:443 -> 192.168.2.3:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.186.224.25:443 -> 192.168.2.3:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.138.248:443 -> 192.168.2.3:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.138.248:443 -> 192.168.2.3:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.138.248:443 -> 192.168.2.3:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.138.248:443 -> 192.168.2.3:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.138.248:443 -> 192.168.2.3:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.138.248:443 -> 192.168.2.3:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.162:443 -> 192.168.2.3:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.162:443 -> 192.168.2.3:49785 version: TLS 1.2

System Summary:

Source: classification engine

Classification label: clean1.win@3/277@24/12

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF434DAF30ABD3692A.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1288 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1288 CREDAT:17410 /prefetch:2

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Drive-by Compromise1	Windows Management Instrumentation	Path Interception	Process Injection1	Masquerading1	OS Credential Dumping	File and Directory Discovery1	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://theragcompany.de/shaming.php	0%	Virustotal		Browse
https://theragcompany.de/shaming.php	0%	Avira URL Cloud	safe

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
scdnco.spotify.map.fastly.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
https://theragcompany.de/wp-content/uploads/2020/01/TRC-banner-website.png	0%	Avira URL Cloud	safe
https://theragcompany.de/product-categorie/neuheiten/	0%	Avira URL Cloud	safe
https://fontawesome.comhttps://fontawesome.comFont	0%	Avira URL Cloud	safe
https://theragcompany.de/wp-content/cache/fvm/min/theragcompany.de/1614093251-75a49f264d33bbcb6b5c66	0%	Avira URL Cloud	safe
https://www.internalfb.com/intern/invariant/	0%	URL Reputation	safe
https://www.internalfb.com/intern/invariant/	0%	URL Reputation	safe
https://www.internalfb.com/intern/invariant/	0%	URL Reputation	safe
https://theragcompany.de/wp-json/	0%	Avira URL Cloud	safe
https://wpbakery.com)	0%	Avira URL Cloud	safe
https://theragcompany.de/ZThe	0%	Avira URL Cloud	safe
https://theragcompany.de/product-categorie/hersteller-marken/kxk-dynamics/	0%	Avira URL Cloud	safe
https://theragcompany.de/product-categorie/fahrzeugwasche/dekontamination/	0%	Avira URL Cloud	safe
https://theragcompany.de/wp-content/themes/woodmart/js/theme.min.js?ver=5.3.6	0%	Avira URL Cloud	safe
https://theragcompany.de/wp-content/plugins/woocommerce/assets/js/js-cookie/js.cookie.min.js?ver=2.1	0%	Avira URL Cloud	safe
https://theragcompany.de/wp-content/plugins/woocommerce/assets/js/selectWoo/selectWoo.full.min.js?ve	0%	Avira URL Cloud	safe
https://theragcompany.de/product-categorie/fahrzeugwasche/spruhversiegelung-detailer/	0%	Avira URL Cloud	safe
https://theragcompany.de/art/pany.de/wp-content/uploads/2020/01/cropped-TheRagCompanyFavicon-100x100	0%	Avira URL Cloud	safe
https://theragcompany.de/product/goizper-ik-multi-pro-2-druckpumpspruher/	0%	Avira URL Cloud	safe
https://www.theragcompany.de/wp-content/uploads/2020/06/DHL-Logo-e1595003749295.png	0%	Avira URL Cloud	safe
https://theragcompany.de/account/	0%	Avira URL Cloud	safe
https://theragcompany.de/product-categorie/sparpakete/testpakete/	0%	Avira URL Cloud	safe
https://theragcompany.de/product-categorie/versiegelung-wachs/versiegelungsprodukte/	0%	Avira URL Cloud	safe
https://theragcompany.de/product-categorie/innenraum/reinigung-pflege/	0%	Avira URL Cloud	safe
https://theragcompany.de/product-categorie/merchandise/	0%	Avira URL Cloud	safe
https://theragcompany.de/cart/ts/login/?next=/theragcompanyde/	0%	Avira URL Cloud	safe
https://theragcompany.de/business-program/v	0%	Avira URL Cloud	safe
http://daneden.me/animate	0%	URL Reputation	safe
http://daneden.me/animate	0%	URL Reputation	safe
http://daneden.me/animate	0%	URL Reputation	safe
https://theragcompany.de/product-categorie/innenraum/	0%	Avira URL Cloud	safe
https://theragcompany.de/wp-content/plugins/js_composer/assets/lib/bower/font-awesome/css/v4-shims.m	0%	Avira URL Cloud	safe
https://theragcompany.de/product-categorie/fahrzeugwasche/motorraum/	0%	Avira URL Cloud	safe
https://una.im/CSSgram/	0%	URL Reputation	safe
https://una.im/CSSgram/	0%	URL Reputation	safe
https://una.im/CSSgram/	0%	URL Reputation	safe
https://theragcompany.de/product-categorie/fahrzeugwasche/scheiben/	0%	Avira URL Cloud	safe
https://theragcompany.de/product/goizper-ik-foam-pro-12-druckpumpspruher/	0%	Avira URL Cloud	safe
http://www.wikipedia.com/	0%	URL Reputation	safe
http://www.wikipedia.com/	0%	URL Reputation	safe
http://www.wikipedia.com/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
star-mini.c10r.facebook.com	31.13.92.36	true	false		high
scontent-frx5-1.xx.fbcdn.net	185.60.216.19	true	false		high
scdnco.spotify.map.fastly.net	199.232.138.248	true	false	0%, Virustotal, Browse	unknown
twitter.com	104.244.42.193	true	false		high
i.ytimg.com	172.217.16.150	true	false		high
fbcdn.net	31.13.92.36	true	false		high
fbsbx.com	31.13.92.36	true	false		high
scontent.xx.fbcdn.net	157.240.27.27	true	false		high
googleads.g.doubleclick.net	142.250.186.162	true	false		high
www.theragcompany.de	185.104.28.118	true	false		unknown
scontent-frt3-2.xx.fbcdn.net	157.240.20.19	true	false		high
edge-web-split-geo.dual-gslb.spotify.com	35.186.224.25	true	false		high
photos-ugc.l.googleusercontent.com	142.250.186.65	true	false		high
theragcompany.de	185.104.28.118	true	false		unknown
facebook.com	31.13.92.36	true	false		high
z-p42-instagram.c10r.facebook.com	31.13.92.174	true	false		high
cs510.wpc.edgecastcdn.net	152.199.21.141	true	false		high
open.scdn.co	unknown	unknown	false		high
www.facebook.com	unknown	unknown	false		high
m.facebook.com	unknown	unknown	false		high
external-frt3-2.xx.fbcdn.net	unknown	unknown	false		high
yt3.ggpht.com	unknown	unknown	false		high
abs.twimg.com	unknown	unknown	false		high
open.spotify.com	unknown	unknown	false		high
i.scdn.co	unknown	unknown	false		high
static.doubleclick.net	unknown	unknown	false		high
static.xx.fbcdn.net	unknown	unknown	false		high
www.instagram.com	unknown	unknown	false		high
www.youtube.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Reputation
https://theragcompany.de/business-program/	false	unknown
https://theragcompany.de/shop/	false	unknown
https://theragcompany.de/	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://theragcompany.de/wp-content/uploads/2020/01/TRC-banner-website.png	cart[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://twitter.com/share?lang=fr	share[1].htm.2.dr	false		high
https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=fi	login[1].htm0.2.dr	false		high
https://theragcompany.de/product-categorie/neuheiten/	shop[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://twitter.com/share?lang=ga	share[1].htm.2.dr	false		high
https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=en	login[1].htm0.2.dr	false		high
https://fontawesome.comhttps://fontawesome.comFont	fa-regular-400[1].eot0.2.dr, fa-brands-400[1].eot.2.dr, fa-solid-900[1].eot.2.dr	false	Avira URL Cloud: safe	unknown
https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=el	login[1].htm0.2.dr	false		high
https://twitter.com/share?lang=gl	share[1].htm.2.dr	false		high
https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=es	login[1].htm0.2.dr	false		high
https://theragcompany.de/wp-content/cache/fvm/min/theragcompany.de/1614093251-75a49f264d33bbcb6b5c66	shop[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://twitter.com/share?lang=en	share[1].htm.2.dr	false		high
https://www.internalfb.com/intern/invariant/	bsuyEeCTvfm[1].js.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.opensource.org/licenses/mit-license.php	autoptimize_8c7c44f652932dec910e13d2649bf9eb[1].js.2.dr	false		high
https://twitter.com/share?lang=es	share[1].htm.2.dr	false		high
https://twitter.com/share?lang=eu	share[1].htm.2.dr	false		high
https://theragcompany.de/wp-json/	cart[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://wpbakery.com)	1614093251-75a49f264d33bbcb6b5c66000065364281b29e75.min[1].css.2.dr	false	Avira URL Cloud: safe	low
https://www.themepunch.com/support-center	autoptimize_8c7c44f652932dec910e13d2649bf9eb[1].js.2.dr	false		high
https://theragcompany.de/ZThe	{2AFFB837-763F-11EB-90E4-ECF4BB862DED}.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://theragcompany.de/product-categorie/hersteller-marken/kxk-dynamics/	shop[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://abs.twimg.com/responsive-web/client-web-legacy/main.189b0285.js	share[1].htm.2.dr	false		high
https://static.xx.fbcdn.net/rsrc.php/v3/yi/l/0	login[1].htm.2.dr	false		high
https://twitter.com/share?lang=fa	share[1].htm.2.dr	false		high
https://theragcompany.de/product-categorie/fahrzeugwasche/dekontamination/	shop[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://theragcompany.de/wp-content/themes/woodmart/js/theme.min.js?ver=5.3.6	cart[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
http://www.reddit.com/	msapplication.xml4.1.dr	false		high
https://twitter.com/share?lang=fi	share[1].htm.2.dr	false		high
https://www.boldgrid.com/w3-total-cache/	marken[1].htm.2.dr	false		high
https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=de	login[1].htm0.2.dr	false		high
https://twitter.com/share?lang=hr	share[1].htm.2.dr	false		high
http://www.aboutads.info	d4c57d525e26[1].js.2.dr	false		high
https://twitter.com/share?lang=hu	share[1].htm.2.dr	false		high
https://www.youtube.com/generate_204?cpn=	base[1].js.2.dr	false		high
https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=da	login[1].htm0.2.dr	false		high
https://twitter.com/share?lang=en-GB	share[1].htm.2.dr	false		high
https://twitter.com/share?lang=id	share[1].htm.2.dr	false		high
https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=cs	login[1].htm0.2.dr	false		high
http://www.networkadvertising.org/managing/opt_out.asp	d4c57d525e26[1].js.2.dr	false		high
https://api.instagram.com/oembed/?url=https://www.instagram.com/	d4c57d525e26[1].js.2.dr	false		high
http://gmpg.org/xfn/11	marken[1].htm.2.dr, cart[1].htm.2.dr	false		high
https://theragcompany.de/business-program/	{2AFFB837-763F-11EB-90E4-ECF4BB862DED}.dat.1.dr, LETOMXZM.htm.2.dr, shop[1].htm.2.dr, ~DF98A4ECC7A66069B4.TMP.1.dr	false		unknown
https://theragcompany.de/wp-content/plugins/woocommerce/assets/js/js-cookie/js.cookie.min.js?ver=2.1	cart[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://theragcompany.de/wp-content/plugins/woocommerce/assets/js/selectWoo/selectWoo.full.min.js?ve	cart[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://twitter.com/share?lang=gu	share[1].htm.2.dr	false		high
https://theragcompany.de/product-categorie/fahrzeugwasche/spruhversiegelung-detailer/	shop[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://twitter.com/share?lang=fil	share[1].htm.2.dr	false		high
http://malsup.com/jquery/block/	autoptimize_8c7c44f652932dec910e13d2649bf9eb[1].js.2.dr	false		high
https://theragcompany.de/art/pany.de/wp-content/uploads/2020/01/cropped-TheRagCompanyFavicon-100x100	~DF98A4ECC7A66069B4.TMP.1.dr	false	Avira URL Cloud: safe	unknown
https://theragcompany.de/product/goizper-ik-multi-pro-2-druckpumpspruher/	shop[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://twitter.com/share?lang=he	share[1].htm.2.dr	false		high
https://www.theragcompany.de/wp-content/uploads/2020/06/DHL-Logo-e1595003749295.png	marken[1].htm.2.dr, cart[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://twitter.com/share?lang=hi	share[1].htm.2.dr	false		high
https://static.xx.fbcdn.net/rsrc.php/v3/ya/r/O2aKM2iSbOw.png	imagestore.dat.2.dr, ~DF98A4ECC7A66069B4.TMP.1.dr	false		high
https://theragcompany.de/account/	shop[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://theragcompany.de/product-categorie/sparpakete/testpakete/	shop[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=bn	login[1].htm0.2.dr	false		high
https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=bg	login[1].htm0.2.dr	false		high
https://static.xx.fbcdn.net/rsrc.php/v3/yT/l/0	login[1].htm.2.dr	false		high
https://static.xx.fbcdn.net/rsrc.php/v3/yF/r/pyYQnfyFuM4.js?_nc_x=Ij3Wp8lg5Kz	theragcompanyde[2].htm.2.dr	false		high
https://i.instagram.com/api/	5f29fc3b8e16[1].js.2.dr	false		high
https://www.instagram.com/accounts/login/	login[1].htm0.2.dr	false		high
https://theragcompany.de/product-categorie/versiegelung-wachs/versiegelungsprodukte/	shop[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://theragcompany.de/product-categorie/innenraum/reinigung-pflege/	shop[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://theragcompany.de/product-categorie/merchandise/	shop[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
http://www.twitter.com/	msapplication.xml5.1.dr	false		high
https://twitter.com/share?lang=kn	share[1].htm.2.dr	false		high
https://twitter.com/share?lang=ko	share[1].htm.2.dr	false		high
https://theragcompany.de/cart/ts/login/?next=/theragcompanyde/	~DF98A4ECC7A66069B4.TMP.1.dr	false	Avira URL Cloud: safe	unknown
https://fontawesome.com/license/free	1614093251-75a49f264d33bbcb6b5c66000065364281b29e75.min[1].css.2.dr	false		high
https://theragcompany.de/business-program/v	~DF98A4ECC7A66069B4.TMP.1.dr	false	Avira URL Cloud: safe	unknown
https://youtu.be/	base[1].js.2.dr	false		high
https://twitter.com/share?lang=it	share[1].htm.2.dr	false		high
https://static.xx.fbcdn.net/rsrc.php/v3/yL/r/OOZ5Mnw2bdX.js?_nc_x=Ij3Wp8lg5Kz	theragcompanyde[2].htm.2.dr	false		high
https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=af	login[1].htm0.2.dr	false		high
https://i.ytimg.com/vi/sWLShHJm11w/maxresdefault.jpg	sWLShHJm11w[1].htm.2.dr	false		high
http://daneden.me/animate	1614093251-7ddc83436b566bc22bb74d9fc8f810c05c8b2daf.min[1].css.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.youtube.com/watch?v	6zO8wnqD4xU[1].htm.2.dr, sWLShHJm11w[1].htm.2.dr	false		high
https://twitter.com/sh	{2AFFB837-763F-11EB-90E4-ECF4BB862DED}.dat.1.dr	false		high
https://static.xx.fbcdn.net/rsrc.php/v3/y_/r/6iW1q19tush.js?_nc_x=Ij3Wp8lg5Kz	theragcompanyde[2].htm.2.dr	false		high
https://twitter.com/share?lang=ja	share[1].htm.2.dr	false		high
https://i.ytimg.com/vi/6zO8wnqD4xU/hqdefault.jpg?sqp	6zO8wnqD4xU[1].htm.2.dr	false		high
https://theragcompany.de/product-categorie/innenraum/	shop[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://theragcompany.de/wp-content/plugins/js_composer/assets/lib/bower/font-awesome/css/v4-shims.m	cart[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://abs.twimg.com/responsive-web/client-web-legacy/polyfills.e0f21315.js	share[1].htm.2.dr	false		high
https://theragcompany.de/product-categorie/fahrzeugwasche/motorraum/	shop[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://help.instagram.com/1009785806132609	d4c57d525e26[1].js.2.dr	false		high
https://una.im/CSSgram/	rs6[1].css.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.nytimes.com/	msapplication.xml3.1.dr	false		high
https://www.instagram.com/accounts/login/?next=/theragcompanyde/&hl=fr-ca	login[1].htm0.2.dr	false		high
https://theragcompany.de/product-categorie/fahrzeugwasche/scheiben/	shop[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://i.instagram.com	5f29fc3b8e16[1].js.2.dr	false		high
https://theragcompany.de/product/goizper-ik-foam-pro-12-druckpumpspruher/	shop[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://getbootstrap.com/)	1614093251-75a49f264d33bbcb6b5c66000065364281b29e75.min[1].css.2.dr	false		high
https://twitter.com/share?lang=mr	share[1].htm.2.dr	false		high
https://twitter.com/share?lang=ms	share[1].htm.2.dr	false		high
http://www.wikipedia.com/	msapplication.xml6.1.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
35.186.224.25	unknown	United States	15169	GOOGLEUS	false
142.250.186.162	unknown	United States	15169	GOOGLEUS	false
31.13.92.36	unknown	Ireland	32934	FACEBOOKUS	false
31.13.92.14	unknown	Ireland	32934	FACEBOOKUS	false
104.244.42.193	unknown	United States	13414	TWITTERUS	false
185.104.28.118	unknown	Netherlands	206281	AS-ZXCSNL	false
157.240.20.19	unknown	United States	32934	FACEBOOKUS	false
185.60.216.19	unknown	Ireland	32934	FACEBOOKUS	false
199.232.138.248	unknown	United States	54113	FASTLYUS	false
152.199.21.141	unknown	United States	15133	EDGECASTUS	false
157.240.27.27	unknown	United States	32934	FACEBOOKUS	false
31.13.92.174	unknown	Ireland	32934	FACEBOOKUS	false

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	356825
Start date:	23.02.2021
Start time:	17:24:38
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 22s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	browseurl.jbs
Sample URL:	https://theragcompany.de/shaming.php
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@3/277@24/12
Cookbook Comments:	Adjust boot time Enable AMSI Browsing link: https://www.facebook.com/sharer/sharer.php?u= Browsing link: https://twitter.com/share?url= Browsing link: https://www.facebook.com/theragcompanyde/ Browsing link: https://www.instagram.com/theragcompanyde/ Browsing link: https://theragcompany.de/ Browsing link: https://theragcompany.de/cart/ Browsing link: https://theragcompany.de/shop/ Browsing link: https://theragcompany.de/marken/ Browsing link: https://theragcompany.de/business-program/ Browsing link: https://theragcompany.de/referenzen/
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. TCP Packets have been reduced to 100 Created / dropped Files have been reduced to 100 Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, dllhost.exe, ielowutil.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, UsoClient.exe Excluded IPs from analysis (whitelisted): 23.211.6.115, 104.42.151.234, 104.43.193.48, 52.147.198.201, 88.221.62.148, 142.250.185.202, 142.250.186.131, 184.30.24.56, 152.199.19.161, 51.104.144.132, 2.20.142.209, 2.20.142.210, 142.250.185.174, 142.250.185.206, 142.250.185.238, 216.58.212.174, 142.250.74.206, 142.250.186.78, 142.250.186.110, 142.250.186.142, 172.217.18.110, 172.217.23.110, 216.58.212.142, 142.250.185.78, 172.217.16.142, 142.250.185.110, 142.250.185.142, 142.250.185.102, 142.250.185.164 Excluded domains from analysis (whitelisted): gstaticadssl.l.google.com, au.download.windowsupdate.com.edgesuite.net, arc.msn.com.nsatc.net, store-images.s-microsoft.com-c.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, e11290.dspg.akamaiedge.net, iecvlist.microsoft.com, e12564.dspb.akamaiedge.net, go.microsoft.com, audownload.windowsupdate.nsatc.net, www.google.com, watson.telemetry.microsoft.com, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, fonts.googleapis.com, fs.microsoft.com, fonts.gstatic.com, ie9comview.vo.msecnd.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, static-doubleclick-net.l.google.com, skypedataprdcolcus15.cloudapp.net, skypedataprdcoleus16.cloudapp.net, youtube-ui.l.google.com, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, go.microsoft.com.edgekey.net, skypedataprdcolwus16.cloudapp.net, cs9.wpc.v0cdn.net Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing network information. Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtDeviceIoControlFile calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\2K5ZUQAA\www.youtube[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	433
Entropy (8bit):	4.489398022666342
Encrypted:	false
SSDEEP:	12:JsrsrsrsrsrUua/Sd4QQrsrUua/AW/QQrsrUua/3QQrsrUua/QQQrS:W0000UJu4QI0UJAwQI0UJ3QI0UJQQIS
MD5:	146033C55395EC5CD20EEA6B45C1D50B
SHA1:	A318098343CECD9FD3AE773DB3DE4A54554110D1
SHA-256:	B0F11F02670B39C4DFC3407377C348B54D07E5A1206CDE6A646C455D3FA21C91
SHA-512:	1D2E826EBE5867A42FDE1C2F8A9D32D0EAD397B42882B9B027453F0A07865D486D7250B5CDFB707E73CDFC3B2DEAEF8418F1A00DCE0A139AF6E961EF1C97EBBF
Malicious:	false
Reputation:	low
Preview:	<root></root><root></root><root></root><root></root><root></root><root><item name="__sak" value="1" ltime="508988768" htime="30870092" /></root><root></root><root><item name="__sak" value="1" ltime="538338768" htime="30870092" /></root><root></root><root><item name="__sak" value="1" ltime="660338768" htime="30870092" /></root><root></root><root><item name="__sak" value="1" ltime="774458768" htime="30870092" /></root><root></root>

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\727YLJ99\twitter[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.281145026820242
Encrypted:	false
SSDEEP:	3:D90aK1ryRtFwsDAqvI9WpXsqSQV2eFK1r0aK1r0aKb:JFK1rUFvAqyEIQV+1rFK1rFKb
MD5:	1A2F9542CE22922783DE181B79003270
SHA1:	79CA94373C8E03409342435F665FAA363FDF9C15
SHA-256:	03F1ADDE749615864B59A721082B696E1498182D5524E9A5F49E728DBF202E1A
SHA-512:	0368E27DC81320574C0F515EFC8E550AB134F0ADA6940AD4C6C907CC3BCB1F2B73935DCDC2A2582C97C5F9E0F2173D817C453D8F5CF0EF0425F10D96D86562B2
Malicious:	false
Reputation:	low
Preview:	<root></root><root><item name="test" value="a" ltime="45458768" htime="30870092" /></root><root></root><root></root>

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\REZY0359\www.instagram[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.469670487371862
Encrypted:	false
SSDEEP:	3:D90aKb:JFKb
MD5:	C1DDEA3EF6BBEF3E7060A1A9AD89E4C5
SHA1:	35E3224FCBD3E1AF306F2B6A2C6BBEA9B0867966
SHA-256:	B71E4D17274636B97179BA2D97C742735B6510EB54F22893D3A2DAFF2CEB28DB
SHA-512:	6BE8CEC7C862AFAE5B37AA32DC5BB45912881A3276606DA41BF808A4EF92C318B355E616BF45A257B995520D72B7C08752C0BE445DCEADE5CF79F73480910FED
Malicious:	false
Reputation:	low
Preview:	<root></root>

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\YUI1WIEX\m.facebook[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	45460
Entropy (8bit):	5.5422656533212775
Encrypted:	false
SSDEEP:	768:Pb5Sb5Gb77Y7Y2KY2WY2hY2W12W12i12k12K12K12X12X12l12512h12HPCI6+:WL+
MD5:	FFB61AA53B3141FC105308D25BBA89B8
SHA1:	4A32330EFF56EB00EBB3FFB6AE2CBCE6E12C67DD
SHA-256:	307C2F23FD3F8A555AB5E01FF9226C47BF4636DC3F9499700DBD7C3C7AF7C69B
SHA-512:	0E6146595B5B921D7AC17A8DF6B35BEBCF27C5F334DF63A864B53E8B7233AD5C7C39E6B3E74265E1B23F05DF8292A141280A24F4F8C20DE432A56A2569E94420
Malicious:	false
Reputation:	low
Preview:	<root></root><root><item name="CacheStorageVersion" value="3b" ltime="13308768" htime="30870092" /><item name="_cs_version" value="_@_2h" ltime="13308768" htime="30870092" /><item name="_cs_viewer" value="0" ltime="13308768" htime="30870092" /><item name="Session" value="uj0146:1614129992794" ltime="13428768" htime="30870092" /></root><root><item name="CacheStorageVersion" value="3b" ltime="13308768" htime="30870092" /><item name="_cs_version" value="_@_2h" ltime="13308768" htime="30870092" /><item name="_cs_viewer" value="0" ltime="13308768" htime="30870092" /><item name="Session" value="uj0146:1614129992794" ltime="13428768" htime="30870092" /><item name="mutex_falco_queue_log^$" value="6chf6u:1614129958927" ltime="14748768" htime="30870092" /><item name="mutex_falco_queue_immediately^$" value="6chf6u:1614129958929" ltime="14788768" htime="30870092" /></root><root><item name="CacheStorageVersion" value="3b" ltime="13308768" htime="30870092" /><item name="_cs_version" value="_@_2h" lt

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2AFFB835-763F-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	45656
Entropy (8bit):	1.9271453621249894
Encrypted:	false
SSDEEP:	192:r/Z0Z72ksWk7tkPfkBBMk+k7kEfkZMrk2kKkxkrkRr:rhESk7k5knkkk+k7kqkkk2kKkxkrkRr
MD5:	345EFD4832F510AF3BC84F3F4EB2C536
SHA1:	C92AD9953B52D062111434B32D00D77A2701BDE7
SHA-256:	E196ADA159B9204A2407195220355A9EF1ADDAF3C810E8B9DE7D556882080A57
SHA-512:	B7C5C426C4C363348F7951DAB857B36317AF20147B36A9ED1E32A4B52428090A3FDEE10EEB3569F5E1093B18A6E838AD01436767A4788D7C360ADF216D76C814
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{2AFFB837-763F-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	195834
Entropy (8bit):	2.560838513293543
Encrypted:	false
SSDEEP:	384:rAg3D30kSFBb0jk0CMtuV2/R7qGpNEfoGGpY1Pb6e/81BH/pi86l6v9rnl4bS9nA:+g/qmp7jDw
MD5:	1C13F602C8276A9C8070AE2DD4D1B620
SHA1:	1603072767BF906BEA021D08277CFE65DF5C406F
SHA-256:	68D413A6B54B49A55FCCD45D5349E1D5C5DA70483D900B78BFAC48B6C546EF1D
SHA-512:	D08443E351E8345BA5AECF72949EE78970C483F1E56DB0AA54B944CD0CAF9D0FB4BC300BE9B2D51CF809FD0DF491CB61815E880F9C8EE3FA6E1B0AE9473436A1
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{33742F4F-763F-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	16984
Entropy (8bit):	1.5632218600469416
Encrypted:	false
SSDEEP:	48:IwxGcpr0Gwpa+G4pQKmGrapbS6GQpKZWG7HpRJTGIpG:rHZMQ+6VBSCAZBTvA
MD5:	0C6B4033303EDC6DFB3C2B75F3482233
SHA1:	128E4790F53304BA3B6C66AD1154F76964232A0F
SHA-256:	28B6EC4DD15CA241FFD4B07D96D1B22AE7746AA7B2F150CAE9D3A73AFB95933B
SHA-512:	06417219105CA8DA4D914916E91D4ADC919859DBFF0151DEF851E0A0A5F4840154034A92D888BB6741F3787F21C0BCAA6D80196FBF1B44D478807B3D86227B80
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	656
Entropy (8bit):	5.1137276316258875
Encrypted:	false
SSDEEP:	12:TMHdNMNxOEB0BF01nWimI002EtM3MHdNMNxOEB0B+01nWimI00ObVbkEtMb:2d6NxOG4FaSZHKd6NxOG4+aSZ76b
MD5:	A9506338C2B37EECB449E6648AC29EDD
SHA1:	296741D907DA82FFB4A41B35A5CEEF9CEC437303
SHA-256:	103D172D79BF1A1F5422EB7DF088D660216F00C84D744B9E0ABE5149C94F146D
SHA-512:	A41110D08C5A20A0C304EA6C9202C5B0E1F7A5293389674FC999F3FA39C749D043D96BC8E21BFA7DBA86C58F4101A532C5F975F5720D2694289B642FEBA899CF
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x123255f9,0x01d70a4c</date><accdate>0x123255f9,0x01d70a4c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x123255f9,0x01d70a4c</date><accdate>0x1234b871,0x01d70a4c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	653
Entropy (8bit):	5.115502923543811
Encrypted:	false
SSDEEP:	12:TMHdNMNxe2ksX0BYX01nWimI002EtM3MHdNMNxe2ksX0BjrV01nWimI00Obkak6t:2d6NxrNX4YXaSZHKd6NxrNX4PVaSZ7AS
MD5:	4E2379615E5A9C172F932F6B199E30FE
SHA1:	610A77ACE8C87C45651C552F81B632AEA35CDD76
SHA-256:	ECA2E36A7F2B17E6A619A9C81E151B0E6F2D7A4936E059B8C46BC2E6FB4BDEB2
SHA-512:	38F564338538550AF063AAC7D4AD1499E1D1B009E5F35E5622CFE3410DA1A8AD5E85FFF1515597F6D7E6BB2433E48CC41A828E45B297E51E81D533B55B06F6BB
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.amazon.com/"/><date>0x1221a599,0x01d70a4c</date><accdate>0x1221a599,0x01d70a4c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.amazon.com/"/><date>0x1221a599,0x01d70a4c</date><accdate>0x1228cc9e,0x01d70a4c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Amazon.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	662
Entropy (8bit):	5.111900933999828
Encrypted:	false
SSDEEP:	12:TMHdNMNxvLS0B+01nWimI002EtM3MHdNMNxvLS0B+01nWimI00ObmZEtMb:2d6Nxve4+aSZHKd6Nxve4+aSZ7mb
MD5:	820A0777B423566D4B61B8A00E87ED6C
SHA1:	4E0C877CA4B10A1A2BE6F975B9E94F9DF1DDF2CC
SHA-256:	36E99B54F032628AAC94480158CD68AADEB00083EDE8AFB555C4EEDD3F1BB5DA
SHA-512:	53BFD5C4E8B15740B31D3651C7935B3202CFF7A648514892A8CEFC26F105E8C300DA46489E210A0DC2A1AC0647EE33170C3CE962A8D1B41BB3A7420CB7D4F4DA
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.wikipedia.com/"/><date>0x1234b871,0x01d70a4c</date><accdate>0x1234b871,0x01d70a4c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.wikipedia.com/"/><date>0x1234b871,0x01d70a4c</date><accdate>0x1234b871,0x01d70a4c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Wikipedia.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	647
Entropy (8bit):	5.088617004182439
Encrypted:	false
SSDEEP:	12:TMHdNMNxidgBk0BxgBk01nWimI002EtM3MHdNMNxidgBk0BxgBk01nWimI00Obd/:2d6NxiEk4xEkaSZHKd6NxiEk4xEkaSZ5
MD5:	4D1C2E898AE78C0372FE5C8940B92684
SHA1:	C84AEC4110446C5D424A1975E458861E4AF2F233
SHA-256:	FC9618E1AE5242AA374D5AB6FFBA96B1CB08F5A9793F2846A144762CA0FF8B5A
SHA-512:	2425EA4C0CDD1120571C33EEFFDD961E584CF47FA52F8810FFD7293F69778A40D26DDE23C362D53EAC2491FBA1D68BCC39EF1ADF834472B1E1D590593FB5BB58
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.live.com/"/><date>0x122ff37d,0x01d70a4c</date><accdate>0x122ff37d,0x01d70a4c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.live.com/"/><date>0x122ff37d,0x01d70a4c</date><accdate>0x122ff37d,0x01d70a4c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Live.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	656
Entropy (8bit):	5.123841680956479
Encrypted:	false
SSDEEP:	12:TMHdNMNxhGwS0B+01nWimI002EtM3MHdNMNxhGwS0B+01nWimI00Ob8K075EtMb:2d6NxQd4+aSZHKd6NxQd4+aSZ7YKajb
MD5:	F461A62C01B4B6A12E50B32E5EB5C02B
SHA1:	1041235E7825AB7AE2D05C4D8EF5A777B4FABE43
SHA-256:	4B59761857CFA2A2BFE146E57D56C9CE7A6402EC93A79072E9483D22039D524C
SHA-512:	73149258E656AD4CEBA8FE7568EC83EDB400FECCC76EA1EB6BE612F48D1558C1CE4ECFBE4BF764040B6F96027BF4871148AC49D4910A3C1E9A4687E90E3067CB
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x1234b871,0x01d70a4c</date><accdate>0x1234b871,0x01d70a4c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x1234b871,0x01d70a4c</date><accdate>0x1234b871,0x01d70a4c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	653
Entropy (8bit):	5.113989293646379
Encrypted:	false
SSDEEP:	12:TMHdNMNx0nB0BF01nWimI002EtM3MHdNMNx0nB0BF01nWimI00ObxEtMb:2d6Nx0B4FaSZHKd6Nx0B4FaSZ7nb
MD5:	9B77514E4064BBE04AF747F830F3C0A5
SHA1:	DD9D5BD3B0399861329B5B23D3966EB11B35D392
SHA-256:	0C16979A0DB1E527C8E2BC04E9A1BF9B6AA6D0D44CE4518ECF4ED6ACBDFB10CC
SHA-512:	DF36AAC5A056749894435C187173D83FC0D2D46CFF0C3D7E614F8AA13496DF238997318E6E1B026A713311EA9254E846BA10410D12E482DEFFE931AC3187FF35
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.reddit.com/"/><date>0x123255f9,0x01d70a4c</date><accdate>0x123255f9,0x01d70a4c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.reddit.com/"/><date>0x123255f9,0x01d70a4c</date><accdate>0x123255f9,0x01d70a4c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Reddit.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	656
Entropy (8bit):	5.129457301846879
Encrypted:	false
SSDEEP:	12:TMHdNMNxxdgBk0BxgBk01nWimI002EtM3MHdNMNxxdgBk0BF01nWimI00Ob6Kq5t:2d6NxXEk4xEkaSZHKd6NxXEk4FaSZ7ob
MD5:	489192ACE3E35F1D041B549205193BCA
SHA1:	E16D072DB4671EF160EC8736F81B17A0F56D6DB3
SHA-256:	21746FB70D0400AB0425FEA3BB02BDEB4A9CC937598FC5EBE9911415CBF5C4DC
SHA-512:	E3B4F72F058F068C7B5965AE7D6DEA93193184A7788E05D0D328C38DD7D05089E0F90CEECB8464609C32245EA6383FE05E7FA9B364BA30590D00838EA0F87C2E
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.nytimes.com/"/><date>0x122ff37d,0x01d70a4c</date><accdate>0x122ff37d,0x01d70a4c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.nytimes.com/"/><date>0x122ff37d,0x01d70a4c</date><accdate>0x123255f9,0x01d70a4c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\NYTimes.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	659
Entropy (8bit):	5.125499175878656
Encrypted:	false
SSDEEP:	12:TMHdNMNxcak0Buk01nWimI002EtM3MHdNMNxcak0Buk01nWimI00ObVEtMb:2d6Nx447aSZHKd6Nx447aSZ7Db
MD5:	4E29F6A7239D2424849F97AE03811458
SHA1:	5459CC5F8F79B2262319CE7DBB306CBA3727A5B1
SHA-256:	461303BBD3A65B30EB7268507C35C0792BA0630F6C8A64FD3BE1E9E25BFB49E9
SHA-512:	A8D119C82E2D6ED63A1DA222350AA627AEAD0361574481E637BA8977119B23935C958FCE89305E4D3629DEDE73E293AE40FC2299F1E6CE09A039217362BBB284
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x122d9126,0x01d70a4c</date><accdate>0x122d9126,0x01d70a4c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x122d9126,0x01d70a4c</date><accdate>0x122d9126,0x01d70a4c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	653
Entropy (8bit):	5.074487369779823
Encrypted:	false
SSDEEP:	12:TMHdNMNxfndgBk0BxgBk01nWimI002EtM3MHdNMNxfndgBk0BxgBk01nWimI00Ou:2d6NxFEk4xEkaSZHKd6NxFEk4xEkaSZa
MD5:	8249CADC17E0F141447EB671E2A80AD2
SHA1:	81A6F95359E7188BB35C67E555B2C0F84701F953
SHA-256:	955182C0AF404B9A1EB9FC0BB1A63EA00F3A638A8B3F590E3FFAF6B1C2C59CA7
SHA-512:	65D460D3874972A3581F6E359487273849A125A2377E560D2D0A1CFBAE9616EA9DD826DC4799087C3BC2A49889AFDF2646665E151B062D4E9DF63290311EAF35
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.google.com/"/><date>0x122ff37d,0x01d70a4c</date><accdate>0x122ff37d,0x01d70a4c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.google.com/"/><date>0x122ff37d,0x01d70a4c</date><accdate>0x122ff37d,0x01d70a4c</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Google.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\ynfz0jx\imagestore.dat Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	42884
Entropy (8bit):	7.978774682773544
Encrypted:	false
SSDEEP:	768:qsJgevUngrfG73QYE2YTeVs2l83qUrJhLebkVnIBltygGIFt6TS7NBV5D+:pgevUngrfGzQY1YTeflKqUFN6BKwt6u+
MD5:	98C98EE684BE457AD5263F828F3A51B2
SHA1:	675B138AD76E03E9EF4D71F12468E58302DBAA32
SHA-256:	AC24FA443678B115DE7191A61D198E2290981F80B8D05F61641761D6F984E7CB
SHA-512:	2737D0F83E69CD8953340B2AA28E4654D748DB3B0E970BB65A6B60272E825F8F2D9AC281174BC4082343CC88913768C8485C819608C9BFE31A921FFE572A46BD
Malicious:	false
Reputation:	low
Preview:	<.h.t.t.p.s.:././.s.t.a.t.i.c...x.x...f.b.c.d.n...n.e.t./.r.s.r.c...p.h.p./.v.3./.y.a./.r./.O.2.a.K.M.2.i.S.b.O.w...p.n.g......PNG........IHDR..............x~Y...pPLTEc..c..b..b..b..b..a..a..a..`..`..`.._.._..]..]..]..]..\..]..\..[..[~.[~.Z~.Y\|.Y\|.X{.Wz.]~.m........w..Wz........................................................Vw.Tv..........St.Y}....Rs.......Uu....Qr.Vz.Oo.Xz.Wz._}....Vx.{..Mn....Tw.Rt.Tv....St....\\|.................Oq....Tq.Ge.Hg.Kk.Lm.Qs..........bz.Kl.Pq....Mo.Cc.No....Dd.c~.Oo.Mn..........Gh.Jk.Ij.Ln.Hi....Kl....Ik.......A_.Ff.Ee.Bb.Fg.A`...................>].......Dd.......=[.Cc....;Y.@_.?^.......9V.>]....<Z.7S....2O.=\.:X.......6S....<[.9W.;Z....8V....;Y.:X.7V................3Q.0L.6U....0K.1N.5S.4R....3Q.2P.-J.,G..........................K.............?...gtRNS.......................................................................................................N.ec...[IDATx..O.n.0..,[....<..!..v(...:2....G.4;.h..6Y?.`.`wZ....: .!o.T.k...m....Y..:.(.89

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\1487645_6012475414660_1439393861_n[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 10 x 10, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.71696959175789
Encrypted:	false
SSDEEP:	3:yionv//thPlH1tnt/tAhHGZscm1olkqCwbp:6v/lhP6hHDcZCYp
MD5:	8DC258A49B60FAE051E9A7CE11AD05CF
SHA1:	DAFEF280663F4205FC7F0E47799E9945E6A68D6D
SHA-256:	C8CAED93847AFFC154CB3D424E34FC146E7340BB29ABEBD5EBA7063E3DCA0604
SHA-512:	5F11ED60D79A80EF7CCEFFA907CD55F31D8DB19BD2A7F4C2650C62A355C5071C5FB61DA1EB0A2071CE22ECDC35C0D12F51E4D13AAC3B0FDB95ED4629815B5AFB
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..............PX.....IDAT.Wc...0a.!..)....A,....Zl....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\1614093251-75a49f264d33bbcb6b5c66000065364281b29e75.min[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	1662032
Entropy (8bit):	5.046297303072832
Encrypted:	false
SSDEEP:	24576:U+Awlpc+vg7Gf1kNjnyqd66FqWBuV0Ie7:U+Awlpc+vg7LNjnjFqWBuV0Ie7
MD5:	FE6E124C6CB18C5275262944458ED169
SHA1:	B0B452776506673667798EF1737EE26695659A66
SHA-256:	344CA7D20B1EAAA0A0584BC5993F0D93254A21185C09CC4FEF02F2143B5E6937
SHA-512:	A82A85BCCBA42F8B8B85E06866C738F969B4D817D786F00A3860B9A0D113E66B4F91C6A982A74BAEE78EB4DA32BF28303CB0579CDEF03E651AB5BEDB4279A71A
Malicious:	false
Reputation:	low
IE Cache URL:	https://theragcompany.de/wp-content/cache/fvm/min/theragcompany.de/1614093251-75a49f264d33bbcb6b5c66000065364281b29e75.min.css
Preview:	:root{--wp-admin-theme-color:#007cba;--wp-admin-theme-color-darker-10:#006ba1;--wp-admin-theme-color-darker-20:#005a87}#start-resizable-editor-section{display:none}.wp-block-audio figcaption{margin-top:.5em;margin-bottom:1em}.wp-block-audio audio{width:100%;min-width:300px}.wp-block-button__link{color:#fff;background-color:#32373c;border:none;border-radius:1.55em;box-shadow:none;cursor:pointer;display:inline-block;font-size:1.125em;padding:.667em 1.333em;text-align:center;text-decoration:none;overflow-wrap:break-word}.wp-block-button__link:active,.wp-block-button__link:focus,.wp-block-button__link:hover,.wp-block-button__link:visited{color:#fff}.wp-block-button__link.aligncenter{text-align:center}.wp-block-button__link.alignright{text-align:right}.wp-block-button.is-style-squared,.wp-block-button__link.wp-block-button.is-style-squared{border-radius:0}.wp-block-button.no-border-radius,.wp-block-button__link.no-border-radius{border-radius:0!important}.is-style-outline>.wp-block-button__l

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\1614093251-c20063ba28183e9bed802a69f9fdb9d47f04b947.min[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	9749
Entropy (8bit):	5.087256733475713
Encrypted:	false
SSDEEP:	192:rtl9rc9xKhbMtRTskRGLF+AjBRC4ogRBqGRK:rtl9rc9xKhbMzTskcZ+AjTC4oghK
MD5:	A9891754F677B982B7431237E13BD118
SHA1:	C20063BA28183E9BED802A69F9FDB9D47F04B947
SHA-256:	FA4007666BC6322B5494053024CFE2F6943613B240A09A92999A1CE05B769FFB
SHA-512:	1163F72F55B3BAAF11084D51CB31F67EEAFD636E388AA1A5D6DE5C59664FC73435E80B48C1C1284C5F1FD7AF3E5B8581A9B0350B19B0B984D5BC9C13DB2F3B12
Malicious:	false
Reputation:	low
IE Cache URL:	https://theragcompany.de/wp-content/cache/fvm/min/theragcompany.de/1614093251-c20063ba28183e9bed802a69f9fdb9d47f04b947.min.css
Preview:	@font-face{font-family:'Lato';font-style:italic;font-weight:100;font-display:swap;src:url(https://fonts.gstatic.com/s/lato/v17/S6u-w4BMUTPHjxsIPx-oPCQ.woff) format('woff')}@font-face{font-family:'Lato';font-style:italic;font-weight:300;font-display:swap;src:url(https://fonts.gstatic.com/s/lato/v17/S6u_w4BMUTPHjxsI9w2_Gwfr.woff) format('woff')}@font-face{font-family:'Lato';font-style:italic;font-weight:400;font-display:swap;src:url(https://fonts.gstatic.com/s/lato/v17/S6u8w4BMUTPHjxsAXC-s.woff) format('woff')}@font-face{font-family:'Lato';font-style:italic;font-weight:700;font-display:swap;src:url(https://fonts.gstatic.com/s/lato/v17/S6u_w4BMUTPHjxsI5wq_Gwfr.woff) format('woff')}@font-face{font-family:'Lato';font-style:italic;font-weight:900;font-display:swap;src:url(https://fonts.gstatic.com/s/lato/v17/S6u_w4BMUTPHjxsI3wi_Gwfr.woff) format('woff')}@font-face{font-family:'Lato';font-style:normal;font-weight:100;font-display:swap;src:url(https://fonts.gstatic.com/s/lato/v17/S6u8w4BMUTPHh

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\1614093251-ccdf912b15e03c1aff4e7ddd8222098f5ba4a902.min[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	1662769
Entropy (8bit):	5.04644761565695
Encrypted:	false
SSDEEP:	24576:U+Awlpc+vg7Gf1k6jn/qd66FqWBuV0Iec:U+Awlpc+vg7L6jnGFqWBuV0Iec
MD5:	E6C83AF9E2EE80DEDF54C5E4000BD45B
SHA1:	142AE238E301E4274A951660DBBAE6AC17576631
SHA-256:	29CC655F09B2FAA6DA762FD6A1E8D17E3D783049F855A5B1CE0DE2BD0372572F
SHA-512:	D950AF0A286F750115F73E6A42ABFE8B0035D63F12CC6E811D18219CAFDBBC25BED17FA66BF73FF2310D3DFE9B0DCCB5F5BB378015EBF7AD99718A9B859E6865
Malicious:	false
Reputation:	low
IE Cache URL:	https://theragcompany.de/wp-content/cache/fvm/min/theragcompany.de/1614093251-ccdf912b15e03c1aff4e7ddd8222098f5ba4a902.min.css
Preview:	:root{--wp-admin-theme-color:#007cba;--wp-admin-theme-color-darker-10:#006ba1;--wp-admin-theme-color-darker-20:#005a87}#start-resizable-editor-section{display:none}.wp-block-audio figcaption{margin-top:.5em;margin-bottom:1em}.wp-block-audio audio{width:100%;min-width:300px}.wp-block-button__link{color:#fff;background-color:#32373c;border:none;border-radius:1.55em;box-shadow:none;cursor:pointer;display:inline-block;font-size:1.125em;padding:.667em 1.333em;text-align:center;text-decoration:none;overflow-wrap:break-word}.wp-block-button__link:active,.wp-block-button__link:focus,.wp-block-button__link:hover,.wp-block-button__link:visited{color:#fff}.wp-block-button__link.aligncenter{text-align:center}.wp-block-button__link.alignright{text-align:right}.wp-block-button.is-style-squared,.wp-block-button__link.wp-block-button.is-style-squared{border-radius:0}.wp-block-button.no-border-radius,.wp-block-button__link.no-border-radius{border-radius:0!important}.is-style-outline>.wp-block-button__l

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\2d1a983909a0[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	25456
Entropy (8bit):	5.851929810540316
Encrypted:	false
SSDEEP:	384:vvawg1c1vGosJc9t2WZMadNdYwGF9y9R4wk5IlHKKKc1O73qSsRUwHDS:61YvC9gMauhF9KiJAS2S
MD5:	72B9D77886909A5BFD7F28A8464FDD2F
SHA1:	0EF330112B29D9F20C82E084FA87F634A17C57E0
SHA-256:	540AED919314ED435792AF7C30C95CC27B471F0758760E8B23CB2D3169342747
SHA-512:	864D67B2CE9D1DED6E1BA45D1B0A600441C8FD5478903FA60C8EE0D0BDFEFFA1EF462072161BC2378F419C92B25A04FD1BA5188E5A67BA87281B34C5ABA76347
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.instagram.com/static/bundles/metro/FeedPageContainer.css/2d1a983909a0.css
Preview:	._1SP8R{-webkit-box-flex:1;-webkit-flex-grow:1;-ms-flex-positive:1;flex-grow:1;margin:0 auto;max-width:600px;position:relative;width:100%}.j9XKR{display:-webkit-box;display:-webkit-flex;display:-ms-flexbox;display:flex;-webkit-box-orient:horizontal;-webkit-box-direction:normal;-webkit-flex-flow:row nowrap;-ms-flex-flow:row nowrap;flex-flow:row nowrap;max-width:935px}.M_qbh{display:block}.CZW53{margin-bottom:30px}.cGcGK{float:left;margin-right:28px;max-width:614px;width:100%}._8Rm4L:last-child{margin-bottom:0}.Poa9l{-webkit-align-self:center;-ms-flex-item-align:center;align-self:center}._4pe27{-webkit-box-orient:horizontal;-webkit-box-direction:normal;-webkit-flex-direction:row;-ms-flex-direction:row;flex-direction:row;-webkit-box-pack:justify;-webkit-justify-content:space-between;-ms-flex-pack:justify;justify-content:space-between;padding-top:8px}.vJNXS{position:fixed;bottom:0;left:0}.mTGkH{background:0 0;border:0;margin:0;padding:0}._2eEhX{margin-left:-16px}@media (min-width:640px){._

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\32f0a4f27407[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 430 x 401, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	76578
Entropy (8bit):	7.989834035155165
Encrypted:	false
SSDEEP:	1536:/kQcdqbA3ZNbwPN118YNwUNDYmoCI4U9VxU+8DoxZQEMgQ:/kQc8A3ZNbrYNwGYddtDUH++9
MD5:	90E8A7A5302B706B26BA947C85B7603E
SHA1:	1E923C875ACC5BE4B55ECB2FF2CF175C0759BFC4
SHA-256:	12F4C816ADC97F7808A7746329451A4B3FBBC8E8A67BD1337984E6AB6079C6A1
SHA-512:	786283A4F27032AD8C1550D019FC737512E2663C35F1E7B747089C0AB0814411840C5A9890468A016F5096DA93263E51F5FB15B36FE2CE5EE3DBD20A8EA1D934
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.instagram.com/static/bundles/metro/sprite_core_32f0a4f27407.png/32f0a4f27407.png
Preview:	.PNG........IHDR.............=.W....IDATx...\|T.../.....}..C.R....(..)F.(....i. .Q... .@.U.B.`(.. ........!e.....8..nv7w[...e..3....s...Ap.G.....O.Fy.e..7([QN.\DIF.EQ1.e.]d.le..bu.v....6.a!0....>^.L.E.A.".....i.....\.kxM......a.&...8..4..[.{.y.A(K.z.h.j.PH..h...../.....3@.H_.P:...e..@.....y l..a......y...k.........u7LX5..:...!..w.tE......J2J...I.{...f......(......A.L@9......$......Q.QV.,`..=.;.&...>.ks.....z..EX....euU...".P>............x.d.f...:..._.z,>...5t.x..KuP]TgPF2..(.Em./..j.....'w...9.G.3.....9.P._Q...R...;f;G....&.;v.H.<.G........u4......u....=t/.Au.:.Z VN..N.[.....'.EtNX...S.pI.B.D..(u..&.)ay...+.C.R.".N........O...........[eff.,++.YYY...hB...S.V.=G..5t-.C.j..M.....e6.._.P.P>B..(J;..L....k..=\|.eu.r..bW...w DF"(b......:w.\|..t....j.......t.......a.).....G.......{.~f..Lu.c....Z.[..&.H...N.......V.....AuP]T.-.....dpz.G...z...V.y......(..,..x.B..V.(.............".X".lw...i*.&.@X.....OZ.......z......SG.m..5...u.6....-k[ZZ....C.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\4hk0pJW6v-1[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 4-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	160
Entropy (8bit):	5.457769545548505
Encrypted:	false
SSDEEP:	3:yionv//thPl9vhSFmfseoWFWFWFWBVTtS6myKyxtg1bVvP5GQBaFlNxfen3l/Vp:6v/lhPIFmf8WFWFWFWBxQ3yPWbGQBaFA
MD5:	54F5F5C45A18EFAEDB96994E62BAA3A6
SHA1:	40F478CE80B7D7371942DA680CC0AD19B1B064D6
SHA-256:	2A63568AF0E3BE5AE0FCBD0A78D7DA531E90AA3EC9A091E407EFACC821389F5B
SHA-512:	DAD975A07571610010A39A34C15191D491026A58FC704653D3262678BA735C04664B64E22F69A7772C71C5E51DEEBDFF7569C5EFD2D22C77DF90238132C05C47
Malicious:	false
Reputation:	low
IE Cache URL:	https://static.xx.fbcdn.net/rsrc.php/v3/yX/r/4hk0pJW6v-1.png
Preview:	.PNG........IHDR................R....PLTELiq`gp`gp`gp`gp`gp`gpd..\|....tRNS......P.....4IDAT..c` ...20.;..0'.0.....j.BI. C....A4P."....TN... ....tyy....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\68d99ba29cc8[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 192 x 192, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	34715
Entropy (8bit):	7.986303481583946
Encrypted:	false
SSDEEP:	768:s73QYE2YTeVs2l83qUrJhLebkVnIBltygGIFt6TS7NBV5Dx:szQY1YTeflKqUFN6BKwt6u7P7x
MD5:	B407FA101800E44839743A60E6078ED3
SHA1:	18FEA4AD0371ED6CD21007F24A47812BA09B8FA1
SHA-256:	8878662CE6AFC4A995BD80C67652A72642C9564B40CFC5AC94A802D7E0F8B6B1
SHA-512:	D3677616E79B636B8FB9C0E734571824AD4F45876F130D30B7DB14301ECCBE47A78FB4EB05D0823A271D166E088D5FB2DBF9DC8C2718AB646D727ADCF1FAC9FA
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.instagram.com/static/images/ico/favicon-192.png/68d99ba29cc8.png
Preview:	.PNG........IHDR.............R.l....bIDATx..y.mWU&....9.o.w7.$.HB... @J..PP...P.RB......R..YZ`..b.......:.@...BB..>.....k....c.1.Z...sA..~..{.>......7.A.~.m..D...@. ..._...H......H........x$..!8..i......l......:..@......`....,......}.S\|..J.e.........:?...v....F.~O._.R...-......%..M....L.....ep.H......m........_..`..g.......`/....]...\|....,..".......@..Q.......XY`.1aB../...e.S.1.20......c...@.4.OE...\...lFd7...p.....\|.....O.KG.&... .M.5......Eu[D.{..Wk\|d.M.A.F...^_..Uk...A7.M....'...-.T.....l%[....~...L..!....#.... .O..r.$.>.....".X..-_...(......1.W..k.28}.... ...M....x.>.)..F".I/m.;..(\T...c..<.3?h4<.$.pHeL.......k..P.&R.C.Q.!..?5.8.vm.$...C..,.E.....C.pM...w.......S.m.......y.y.F..........!).G(d...(..s3z.8.BR.y.......I$Xiuc.....p2....J.gP...I)...)U.[2..:M...~B....4o`@2..4....~....^..x~...#...N..a..`....X.....=/...yJH....@..)Q..d...F.X...\).....7..M.....#F....2........n..r.5.$.i2....,..&.z.<...juDk.2Rc..3~..s..q.........1.-....8)......[.2.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\7aIpfuPN5vv[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	323
Entropy (8bit):	5.9556324232422195
Encrypted:	false
SSDEEP:	6:6v/lhPf+DkJk/BrYFPw8hM/5CIs0L4VWJqqaUYbfjp:6v/7mkJyB+Y82/cILL4owUYbV
MD5:	7DFBD8DD80FE2F97D01BF56C72FBC40C
SHA1:	1836C689700A3B0A1C432D92EB5C57EFEC7FE96A
SHA-256:	E7918E3E6BD741C93B25645D35DE029D73C4F9B9D055C5EDE99418A6141DDEB4
SHA-512:	D49AD9756B9BC2CF296B97D653AE36FA8341449C39DB43C88F53D20F7E7FA3E69BF2546F7C256656877B67F0F56C10386D520F04305F26B8167B4BE512DABF5B
Malicious:	false
Reputation:	low
IE Cache URL:	https://static.xx.fbcdn.net/rsrc.php/v3/ya/r/7aIpfuPN5vv.png
Preview:	.PNG........IHDR.............(-.S...]PLTELiq.w..w..w..w..w..w..w..w..w..w..w..w..w..w..w..w..w..w..w..w..w..w..w..w..w..w..w..w..w..w.0[a.....tRNS.x..+............*.....].....X.......wIDAT.....b............\R.../sU...`Z.......Z......k...Q.3.-.[...K;P7.w....@U..h..z....0v>...s...PmW(.nU...4TU=.{..G.?B....._....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\7wycyFqCurV[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	421
Entropy (8bit):	6.5459058200365865
Encrypted:	false
SSDEEP:	12:6v/7P+U5JG1lJaM6B/YXzuXKzS+ltNlgEMZtp:+5Sl1EXKzjZyEMB
MD5:	6D7FB5F1269807603938F7760CFCA3D2
SHA1:	88E3BD1ED6979DF5F96900EF3F882EE6E70BA5B5
SHA-256:	B0A9948B922D450244F3EC5E292DB7281D30EFA4C6A63975BBA9893AD372CDE8
SHA-512:	BA41440665990426E0A6BC7D7B7AC00F0E4FCD154BF66E41046C6DCB89211E03BBC91AAA5233A0D5D269CA9D3F1D136868AF33B57291A5114A2D9F02EF0791D1
Malicious:	false
Reputation:	low
IE Cache URL:	https://static.xx.fbcdn.net/rsrc.php/v3/yl/r/7wycyFqCurV.png
Preview:	.PNG........IHDR...............7.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME......+...7....IDAT(..+..P.../...8@....U`...X.........H.m.BV\...Q.3.$.I...W...tJt.zG...Q...\-h..+.$...M.......N....H.M.....`..Rk.....Te. `.2}.2....K.......3......YoP3W...[......L.N..3.(...%tEXtdate:create.2019-02-28T03:46:43-08:00......%tEXtdate:modify.2019-02-28T03:46:43-08:00..T....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\8uhwfRjdcy8[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 12 x 12, 4-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	159
Entropy (8bit):	4.928560754223521
Encrypted:	false
SSDEEP:	3:yionv//thPlmB+4llxiU/oouEf7Mhkx7rNub+FIztulkF8lBjE6leup:6v/lhPoPllxiUQolMhk5r8b+FOtu2KBl
MD5:	1FACBA53866A140CD11B709BD9D144D3
SHA1:	309FF2182678B5E23948FF421B73E2FB48EF7CA7
SHA-256:	3CDB6E84592A075097A283DA40252F25404520A1071DB2AA14E2F9E1397F4C19
SHA-512:	6C839384EB0D2F326585421CB6D91077CE59C13874D6EB44870738BE97EE6748E26C1AEF76C8C6B2823CB86CEF06D446AA343AF1D0A415446E95F5054EEF0E25
Malicious:	false
Reputation:	low
IE Cache URL:	https://static.xx.fbcdn.net/rsrc.php/v3/yo/r/8uhwfRjdcy8.png
Preview:	.PNG........IHDR..............[A.....PLTELiq................................tRNS..T......0.....*IDAT..c`..<Z@$.....r4R.a``.V`2,``Mb`P.`.......O:.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Buisness-Programm-Banner-1-1-e1614088007888[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 1920 x 676, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	872737
Entropy (8bit):	7.997131743997331
Encrypted:	true
SSDEEP:	12288:guUOsJ+KIY476IqRf4SzpcfN7lJSSNw9FREQ2+UDc3L6//mKiLpftsEOfnWVi2RB:gAQnCvqRBpW7/SjvR21kLM/mpl+E9cS
MD5:	3D1959952CC4FDF9450DEE7AE738FB97
SHA1:	54AA8DE5913006D2C817FB0CDF5F47F77FDC3614
SHA-256:	64AD44984793BC5426FE53A7CC85903BB039FF10C33265736C3B6F4DB142BA64
SHA-512:	D2524D4D4C100EA6F79D8AC8FF40609367C03DCDACFD85448F16934C9739B99D74900380CA927A8B8930F977EADA843B144E64571C23F3F1CB09D3E75431949F
Malicious:	false
Reputation:	low
IE Cache URL:	https://theragcompany.de/wp-content/uploads/2020/06/Buisness-Programm-Banner-1-1-e1614088007888.png
Preview:	.PNG........IHDR..............y.s....pHYs..........+......PLTE...M...~.3d....,a................Z..V..<j.)_....].....K..7g.Hq.Q........0c..r.9h....G...j..w..m..{.G..Do.r......e.>l..x.C..o..Am.k...a......U........t.u..H.....Fp.R....e..4f..d.B......}.>......Ms....h.....2..L...o.e...^.$\~*..k........b..a.....3....$_..Ow/..#.......]..B...h.,..<....g..<..P..<....."...u....7..@..(...z........Lt.........@..'..8..z..p......V{5..7i..Z.)...Sz8.."..7...........p.\|.......W{q..1..(a.Z.. \.y.........Sy.PwW..9..3...Z}f..#..v...Gr.Dod..,...T.......a..#...Y~.@m......`.......^...Q.F...4a.:hr...H.]........j...M..X....;..J.. X\|.A..........A...Jsx.....l.."..7..Q........Pw..~..].]...9.^v._m.^~.............c..=>>...WXY...Aq....U.....(((......LMNN{....V..l...Jt...P.....Ay.c..rtuefg.........344x.....4l.{.. 0U$e..q.0......Y.F....f..zr#... .IDATx.\Ah...V.Y}.SI..[........B...M... .M.9...! 0=T....f.....D..C[(....X.A.._.=.P...zH..j....of.c.......7o.o...Rqa.S........q'..r ..]..8.Au..!g........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\BwjU4B_qfpp[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	10635
Entropy (8bit):	5.35073713661032
Encrypted:	false
SSDEEP:	96:ae8ByumvNOJ6pVgqJTw08d54zAlKF/yAuR7RDghD:sByumvYMH+4zAlVDR7RD6
MD5:	6885E0B892F079549788A4F3813E53B3
SHA1:	A6C92E05DCE9D723D695374C2161C9A31A98510E
SHA-256:	17A5F0166D4DAACEA1E94680580A78E51A0FE14919CA734B6EBDEB78E3782D86
SHA-512:	899044EC069195DA2CC106DA1BB2D8A340A89DD3B1F1BA4DE0A5EA4DEB2598C2E0C83D9FF207AE9280F68378F155B32138AA5DA9283D164BC81A48D989E11E10
Malicious:	false
Reputation:	low
IE Cache URL:	https://static.xx.fbcdn.net/rsrc.php/v3/yC/r/BwjU4B_qfpp.js?_nc_x=Ij3Wp8lg5Kz
Preview:	if (self.CavalryLogger) { CavalryLogger.start_js(["KQ+lo"]); }../*. License: https://www.facebook.com/legal/license/HAC-_9WTKIm/. /.__d("flatbuffers",[],(function(a,b,c,d,e,f){var g={};g.Offset;g.Table;g.SIZEOF_SHORT=2;g.SIZEOF_INT=4;g.FILE_IDENTIFIER_LENGTH=4;g.Encoding={UTF8_BYTES:1,UTF16_STRING:2};g.int32=new Int32Array(2);g.float32=new Float32Array(g.int32.buffer);g.float64=new Float64Array(g.int32.buffer);g.isLittleEndian=new Uint16Array(new Uint8Array([1,0]).buffer)[0]===1;g.Long=function(a,b){this.low=a\|0,this.high=b\|0};g.Long.create=function(a,b){return a==0&&b==0?g.Long.ZERO:new g.Long(a,b)};g.Long.prototype.toFloat64=function(){return(this.low>>>0)+this.high4294967296};g.Long.prototype.equals=function(a){return this.low==a.low&&this.high==a.high};g.Long.ZERO=new g.Long(0,0);g.Builder=function(a){if(!a)var b=1024;else var b=a;this.bb=g.ByteBuffer.allocate(b);this.space=b;this.minalign=1;this.vtable=null;this.vtable_in_use=0;this.isNested=!1;this.object_start=0;this.vtable

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\DHL-Logo-e1595003749295[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 200 x 44, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	1737
Entropy (8bit):	7.795477638580875
Encrypted:	false
SSDEEP:	48:Pdr5Nvo7d3crqrli2M7yya4Pep3FWjNWEw:Pl5EEqrlzkyyanFWxWb
MD5:	D4FA0EC04FF7FCE25308D76F231DC20B
SHA1:	EC75F6068126E729A698859121886B2E3240B019
SHA-256:	0412C6759D33315802AE111589F07BEF090F98D00130FCEF631D94BE34D30488
SHA-512:	6F43575B85C1836055CAA47077AAC353211DC5CD9C2080142045CE9F6B22B5B526B7F911C60D0DC1C26DD001CBD02E6E95B3C7FD67CE3FA2CBD1147880A31F06
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.theragcompany.de/wp-content/uploads/2020/06/DHL-Logo-e1595003749295.png
Preview:	.PNG........IHDR.......,......S.8....pHYs..........+.....7PLTE....-...$.......j..d.........(.....(..............).i...$....{........l...(.d..,..+ .c...........E.........(..&........'..&.....(........'..'....9...$.......?...&....=..#!..#.I.....s...$..'.P..A....G..-....u..}..( ...., ..................7......(.e.......]..@..'!.J..W...".....(......V..!".n.....j..>.......&.N..$!.....$.4....o.....&!....U...%.f........`...#....:.....m.. "......' .1..v.."!.g..<....."".J..~..H..;...".......%....8...%.\|..z..O....1..h..t..c..........* .) ..#.2..y...#.w..@........p.....M............$.\|..^..Q..k...........Z..' ..#....D..u.n....tRNS..........[.-....!IDATh..Y.{.@...^.._.....Q.B.B.C.HK]q(..........2.e..}@>...v2...;..x0.....t...~....x.gkq..........A.H..SF.V.../..Zm&o.L...I...cw[)...P..K/.Cl-.X..z...n....+}""[.TY@........r..E.6......)ZG..sD..$e...{E$..6....1jC....l.O..8).j'I[)\q.w.a?k....cB{.h..).t........T?.N....j..q-.zt.H].....m.iK.......aK5.a..6).PA.u.}}+..L.Lmn.~..0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Edgeless-245-All-Purpose-Microfiber-16x16-Terry-Towel-RED-600x600[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 600 x 600, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	143613
Entropy (8bit):	7.996303276057124
Encrypted:	true
SSDEEP:	3072:P0uAwUFt0JARk7qe/048h7DQRO1wBIV2kCYj+0Q+zl72sPalM:J/UsJAKqe/VRU1nXp2UalM
MD5:	5A779C9FD690816D60EEABA06749D161
SHA1:	FDC7FFF65370CA08CC0E6F5A760F0F4039D254FA
SHA-256:	B318FE53CB07A27F50E985D967296FFC61D4FE88EDC718E04C74219FC26E85C5
SHA-512:	FE7289074CEF47A1534ADF13D38C0DD752CA8466A69CC619D3467C7359296DF4D5717B44EC05114155D24ECFE69619FD58756FA9D3EA215DEE967BC001728870
Malicious:	false
Reputation:	low
IE Cache URL:	https://theragcompany.de/wp-content/uploads/2021/02/Edgeless-245-All-Purpose-Microfiber-16x16-Terry-Towel-RED-600x600.png
Preview:	.PNG........IHDR...X...X.......h.....pHYs..........+......PLTE.....?..<..A..;..?..:.....A..D..>..A.....9..9..B..=..<..D..6..8..>..?..7..?..3..=..6..;..@..8..C..A..4..<..A..D..B..C..F..E..:..?..8..;..D..9..1..5..6..?..>..;.....7..F..H..4..9..6..:..@..1..<..:..=..J..K../..8..0..D..5..D.....H..8..>..3..>..G..A..A..3..1..H..6..D..F..6..-..3..:..B..7..;..H../..-..>..3..L..=..3..2..5..7..-..;../..+..6../..9..:..J..,..G..M..?..1..9..)..8..5..2..P..A..5..O..J..2..3..2..6.....-..)..+..N..+..I..-..M../..)..F..'..&../..&..+..3..G..<..2..)..2..(..%..L..E..G..7..E..C..B..".....J..H.."..A..J..Q..<..#../..M..9..S..V..N..D..H..H..J..>..M..?...........W..:..G..T..F..#..;..S.....O.....B..N.....R........@.$Z.....L.0c..........#^..#........X..7...(`.=m..Q....A.Z...J...+Z..'....?.Is.8l..L...d..Ly.}..s..g..U\|..........s..;g......<.y.y.. .IDATx..k.I..K)G.../8...X4..4.........A;...tCg...,.`.t0..x@..'Z&..l....$.@bABH+.~.zU.#y-... i........kBQ.. .C.B.P....B..,...B.P(...`..,...B!X(...B.P....B

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\IMG_1463-2-600x600[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 600x600, frames 3
Category:	downloaded
Size (bytes):	12236
Entropy (8bit):	7.595876904980958
Encrypted:	false
SSDEEP:	192:MSj733SqdtVmmN9XaFo7Z6MeRMEJcQtMTarm7KtUlC6Q2nso1:7bPseAEeR6Qt8Wm7oUlPJso1
MD5:	1AACC0C97DDE31E99EDEDA6F32EEA849
SHA1:	A8EBB79C164AE53D7B017E3BBFF2EF3F0F202E4C
SHA-256:	C04249989A286E7143EF52A9D64DC707EF9CC9D29E2BB3F07E52788EE1CA1065
SHA-512:	2D6A70C8977FBB681B0C4DA3D978994D44117B35C3A4FA8A5542C61DA7599EB3F5C72F5AD94E3A82B38DB71C60D9A623181770106A4523CAC3703785B409E19F
Malicious:	false
Reputation:	low
IE Cache URL:	https://theragcompany.de/wp-content/uploads/2021/02/IMG_1463-2-600x600.jpg
Preview:	......JFIF.............C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$......X.X.."..........................................................................................i....e..=F<......9...9}].)..... .....................#.=......>.r4.v.Q7....V.y..........................S........d...GZ<....v.<n.....Q.=}..P.......................=.....T{.-..o}.G..[Bb.=.n'.n{.....O.vfM@.........................bw..C...<U.....j....-...[U.h.T.z"j.......................oG...jU...pW..g.y.W.{.....]M.h[D.z"j.......................O[..x..8...M.[...{.........6...e............................)jNu.k.7..._.......ou9.N..K....?.....N..p......................y.O.H_.~.s..U...[..^..c..x;....e....[..= ...........................9._'..L.F3...}%..~.._`.j................................#..r....</k...................................F+kQ...6....lrv..Uj........................5..L(.f.O....q.#........................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\IMG_1625-600x600[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 600 x 600, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	57926
Entropy (8bit):	7.977680089400866
Encrypted:	false
SSDEEP:	1536:/DxqlJCsTtOp/LzuOvpXPPWvja4xqGewvVmJ8oG:/DzsQNPWGYlv/oG
MD5:	F1EE7E655C25660149D0199F55402C13
SHA1:	A065607FD80D6A4C5236B602EBF9FD37A48F9A0B
SHA-256:	FB4BD020582138EE758BCFE22DF84C766071288D21AFCC2DCF9D99A490DAF201
SHA-512:	C2B16236274FEABC7937D6EC339D86A15D4D203B7AE8C457A0036387B8C767E7E2130AA3927042CA84263A9A63AB28B2ACD3E71CB851D0A468446DACD3C98534
Malicious:	false
Reputation:	low
IE Cache URL:	https://theragcompany.de/wp-content/uploads/2021/02/IMG_1625-600x600.png
Preview:	.PNG........IHDR...X...X.......h.....pHYs..........+......PLTE......""",--........................778223...//0556...)()%&' . ........................$$$99:...)+,..................==>;;<..................KV^...??@......GQZ.........DNV...@KS8CK<GO......PZbCDD5?E\|..dlt.........x.....AAB_fl..X`fx~.........s{.........QQR(14......hpx......UUV...ede0;@ZZ[...sx.mv.-6;...FFGJ~olkkMNN...^it.........HHI......KKK............_^_sqrf.....................XdpU.v............\|..r{.\|..R........ho].\|S_kO]g.........ywx...~}~...nsz.....t...533u.....l..g..................J..l...............a.............u.......\|:........Y..^.............A}l...V...{.Dmd.vr...3.r:bZ.....o................I.\|T.....B.....C.t....5VPd..z...V^.t~Sql....../JE.rvA&).cl.jg`zx...............2vd@........JS..Y-1.vz...z6=....AI..4A.... .IDATx...ok.{...dFmu2.t2..3F7k".hci..'..0bm.t.!.l....9.J.B....n.I..<..}.{..U.z.'B5...[....7..1255..M..L.1G..D.a"a."c..1...R_a.q2...X'u."'..\|....!_p.:...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\IxxDAbiZepi[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	5731
Entropy (8bit):	5.1263398049427416
Encrypted:	false
SSDEEP:	96:w1JMgRcPl4aWkSlLC+HDqebXHmpYXgrLzGm7tEDJsumLf1z6NBUEE7mWThQS47/1:Megql7WLqebXHmmXgrLz97tED+umL9+B
MD5:	4DBF1775F352DEDF7CC02AB3C94C8AFA
SHA1:	D870E68070F0D3220882C036E4AC8813DB7774BF
SHA-256:	6670252ED5C270D454ADCCBC194FCC084D1DDE11D20C2D65B56AD455E2C1B7BE
SHA-512:	82278F773154CEDE114BA720EDCA17B04ADD3099A988E25E289B15232AECD685297D80449BB7BB9EE5ED0B13877FAB369948BD162AD8C64882AA3911382A926C
Malicious:	false
Reputation:	low
Preview:	.touch ._5m_x{height:0;position:absolute;width:100%;z-index:13}.touch ._3wo2 ._5m_x{z-index:25}._4sc_,._5m_v,._7teu{box-sizing:border-box;overflow:hidden;pointer-events:none;position:absolute;width:100%;z-index:0}._5m_v{padding-bottom:28px}._7teu{align-content:center;display:flex;height:100vh;justify-content:center}._5m_u{border-radius:3px;margin:auto 0;pointer-events:auto;position:relative;text-align:left}._7e0o ._5m_u{background:transparent;border-radius:2.7px;display:block;height:auto !important;margin:0 auto 0 auto;width:83vw}._5m_w{background:rgba(0, 0, 0, .5);bottom:0;left:0;pointer-events:auto;position:fixed;top:-600px;width:100%;z-index:-2}._7e0o ._5m_w{background:rgba(0, 0, 0, .6)}._7e0o ._5m_v{top:50vh;transform:translateY(-50%)}._5m_t>:first-child{border-top-left-radius:3px;border-top-right-radius:3px}._5m_t>:last-child{border-bottom-left-radius:3px;border-bottom-right-radius:3px}._5m_s{background:#fff;border-radius:3px;bottom:0;left:0;position:absolute;right:0;top:0;z-index

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\JopZtdti8dq[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	7270
Entropy (8bit):	5.198628750022657
Encrypted:	false
SSDEEP:	192:4Q7ppcEf3k4TXlM49kfhTvp7J2X3eBCvqK:4af3kUM44vp70X3B
MD5:	52F20D77BCB3763F571037796504BF14
SHA1:	3B1A9CA06FA22D8B9012FED99A6307A73F939AFA
SHA-256:	587B234B1819EDD56FB28552F715B8D1C367A1DD28829D07C3678229C96E650B
SHA-512:	457C0520A803BC030E493218731B33076E4249FD59522BEAB703A34446078DB98CB5257D91EA8741CDCDE7F4B1F11B7C054A1DFEBD24190B47EEE9475DB01A64
Malicious:	false
Reputation:	low
IE Cache URL:	https://static.xx.fbcdn.net/rsrc.php/v3/y_/r/JopZtdti8dq.js?_nc_x=Ij3Wp8lg5Kz
Preview:	if (self.CavalryLogger) { CavalryLogger.start_js(["FEt5G"]); }..__d("CavalryLoggerImpl",["Arbiter","Bootloader","ISB","ImageTimingHelper","KillabyteProfilerConfig","NavigationTimingHelper","PageEvents","PageletEventConstsJS","PageletEventsHelper","PerfXLogger","ResourceTimingBootloaderHelper","ScriptPath","performance","performanceAbsoluteNow"],(function(a,b,c,d,e,f){var g,h,i=b("KillabyteProfilerConfig").htmlProfilerModule,j=b("KillabyteProfilerConfig").profilerModule,k=["t_start","t_paint","t_cstart"],l=window.CavalryLogger;Object.assign(l.prototype,{initializeInstrumentation:function(){if(this.instrumentation_started)return;var a=this;b("Arbiter").subscribe("BigPipe/init",function(b,c){c.lid==a.lid&&c.arbiter&&(a._recordTTIEvent(c.arbiter,"tti_bigpipe"),a._recordDisplayedEvent(c.arbiter,"all_pagelets_displayed"),a._recordLoadedEvent(c.arbiter,"all_pagelets_loaded"),a._recordPageletEventsTime(c.arbiter))});b("Arbiter").subscribe("MRenderingScheduler/init",function(b,c){c.lid==a.lid&&

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\KFOjCnqEu92Fr1Mu51S7ACc6CsI[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 22020, version 1.1
Category:	downloaded
Size (bytes):	22020
Entropy (8bit):	7.969254342778129
Encrypted:	false
SSDEEP:	384:OdR1e4g/v2pwEHXT4vHn5YHPGVubG85NtyZpe21oW4lDXLNXOEGV0u5YN4L5:Oz1e4TpT0/cPGVppl6RLNefY2L5
MD5:	288AD9C6E8B43CF02443A1F499BDF67E
SHA1:	96A90B4B2F04445CEE7091C257D9C7D905BF74B8
SHA-256:	6F2974A396DC0695D071E842551E7AF9C72F0EF8D2D076FE73A523B1A3C2D0E7
SHA-512:	C853526CE2743996089E573DE9D99C9E1B730C41FF3F8F32E316A8ED654EE48CA04A67731D3FBC5F3FB94DB309F99F29F3FA9AC739B1D126BC909858E13C6157
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/roboto/v20/KFOjCnqEu92Fr1Mu51S7ACc6CsI.woff
Preview:	wOFF......V........8........................GDEF.......G...d....GPOS.............~..GSUB.......'......r.OS/2.......N...`t..dcmap...X..........W.cvt ...P...\...\1..Mfpgm.......2......$.gasp................glyf......A...r....\|hdmx..N....l..... ..head..OD...6...6...vhhea..O\|..."...$....hmtx..O....w.....6Kloca..R.........Zs<.maxp..S.... ... .(..name..T.........!.>gpost..T........ .a.dprep..U........X9..x...1..P......PB..U.=l.@..B)..w.......Y.e.u.m.C.s...x.h.~R....R...A.J.x....dK...{....?..F?.\|.~.m...ms.{.Z..;......U.]7s......\.=D.=.7...>....x...D..O\|.U:...\|o..3.x.j.r"B.............../.)x$.'"j.....1LGmaGxQxG....~.:'.A..hd.z,.k..KO.....^.}H\|#z_.O......R..A...9..A..!.(./..."..:.Iq1.r..s..r.7r.7s..q.wr....nz..]...2..d4c..c....d....T.1...d....\....,c9k.g..Yv.#O."%...... ...t"uM..%.......j.#^.....}\c.q.i...<jy.D...C.01.2.r.....V..z.W.7b..L.S.41]..kUs.X/6..b.........(..(...K..{.^..'........`#./..B......N+p.m`...].lQ....Drg.M..Kx.^.S.*..........h ..$.k.'Hy.I.ze..4z.-T.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\KFOjCnqEu92Fr1Mu51TzBic6CsI[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 21588, version 1.1
Category:	downloaded
Size (bytes):	21588
Entropy (8bit):	7.973550860004932
Encrypted:	false
SSDEEP:	384:9do1erd5msN48bPbceGykR88v9yGLRkcl46tW6amtMQSJCo:9+1erd5vCfRzluCSJV
MD5:	81F57861ED4AC74741F5671E1DFF2FD9
SHA1:	AC3993E9EDC4C30C97FE670AA1E8A7088AA69E31
SHA-256:	EEC142608E8B417E2ACB6E5301A750047A04E2C5A6563223CAAE499E19EA08EE
SHA-512:	F23A7D58BE44E474CB65C368B048EB68AA1B6FEF4A12797A4A19C8D9E2F1BB7AB6FCEAE2AD17C59283616503107C332EA6245BF9F721BC49A676E8C92F46EC74
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/roboto/v20/KFOjCnqEu92Fr1Mu51TzBic6CsI.woff
Preview:	wOFF......TT................................GDEF.......G...d....GPOS.............~..GSUB.......'......r.OS/2.......O...`u...cmap...X..........W.cvt ...P...J...J..,ofpgm.......3....c...gasp................glyf......@W..n.S...hdmx..M4...n........head..M....6...6...`hhea..M...."...$....hmtx..N..........=-.loca..P...........maxp..Rh... ... .(..name..R......... .=$post..Sh....... .a.dprep..S.........9..Bx...1..P......PB..U.=l.@..B)..w.......Y.e.u.m.C.s...x.h.~R....R...A.J.x....dK...{....?..F?.\|.~.m...ms.{.Z..;......U.]7s......\.=D.=.7...>....x...D..O\|.U:...\|o..3.x.j.r"B.............../.)x$.'"j.....1LGmaGxQxG....~.:'.A..hd.z,.k..KO.....^.}H\|#z_.O......R..A...9..A..!.(./..."..:.Iq1.r..s..r.7r.7s..q.wr....nz..]...2..d4c..c....d....T.1...d....\....,c9k.g..Yv.#O."%...... ...t"uM..%.......j.#^.....}\c.q.i...<jy.D...C.01.2.r.....V..z.W.7b..L.S.41]..kUs.X/6..b.........(..(...K..{.^..'........`#./..B......N+p.m`...].lQ....Drg.M..Kx.^.S.*..........h ..$.k.'Hy.I.ze..4z.-T.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\KFOmCnqEu92Fr1Mu4mxM[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 19824, version 1.1
Category:	downloaded
Size (bytes):	19824
Entropy (8bit):	7.970306766642997
Encrypted:	false
SSDEEP:	384:ozNCb8EbW9Wg166uwroOp/taiap3K6MC4fsPPuzt+7NCXzS65XZELt:K4zbWcDVwt230hfs+x+Bb65X2
MD5:	BAFB105BAEB22D965C70FE52BA6B49D9
SHA1:	934014CC9BBE5883542BE756B3146C05844B254F
SHA-256:	1570F866BF6EAE82041E407280894A86AD2B8B275E01908AE156914DC693A4ED
SHA-512:	85A91773B0283E3B2400C773527542228478CC1B9E8AD8EA62435D705E98702A40BEDF26CB5B0900DD8FECC79F802B8C1839184E787D9416886DBC73DFF22A64
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxM.woff
Preview:	wOFF......Mp.......P........................GDEF.......G...d....GPOS...............hGSUB............7b..OS/2.......R...`tq#.cmap...........L....cvt .......T...T+...fpgm.......5....w.`.gasp...@............glyf...L..:+..j.....hdmx..Fx...g........head..F....6...6.j.zhhea..G........$....hmtx..G8...]......Vlloca..I.........?.#.maxp..Kt... ... ....name..K........t.U9.post..Ld....... .m.dprep..Lx.......I.f..x...1..P......PB..U.=l.@..B)..w.......Y.e.u.m.C.s...x.h.~R....R.....2.x.....[....#N..m.m.m.mfm....SP..NuM..9]..=.U..!...[........w...\|......^p....H......;...)..........;..EoDo....E.E.D...`.0.GG.aA.H.V.Mx\xA....../..d3.Eb_.J...R.^v........\^ob.}.z..k.x).v$f$..O)+.2..*....y}6`C6b.6cs...l...........!.........<..\|.\|..\|..\|..\|.\|....o....I%.4.L.SI.&C.6..!`...{...c..\.J.(.2.C....V.A..?.M<nG......v..m.;..R.C..aj.H...=..{.>.:.....}i_Y......:....o.&k..KY.2..6k....i]..{,.p}../.....VO3.o].fJ....R-TZ..;...RN..&V...C...3.?.......&..z.s&.D....r,.I...t.R..a$k..Mm..Y.U...+b.%kQ..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\O5aHiOxlYGC[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	16200
Entropy (8bit):	5.344833460476118
Encrypted:	false
SSDEEP:	192:kMFSOXAg6NWQO285dHSLLoMQFHy5s8z7SLbtLXJ2FkxAg7L6lniG+ApeyE8faUEN:LAW/pJMmtZ7kiG+Ay
MD5:	939F136261C29328F6C36634BC4FFA99
SHA1:	F0924C39A73492F63851C6ABB51B7C9B4AA0E9A6
SHA-256:	BEFD657EEE8B72B2E92F143177D7E6630E48A63EBC6D66082D8DA76D8439921E
SHA-512:	495BDE67A6049E14493728EFA8FF04620CD81B9A9DB1510A517F9479F68EAA2CA9E9CAC7693DF9B5839327716DE4887FCD6DF8BFD120B43732A9C589BBB80BA5
Malicious:	false
Reputation:	low
Preview:	.profileMapContainer{height:100px;margin:0 auto;text-align:center}.profileMapTile{background-color:#e7e6e5;background-position:center;background-repeat:no-repeat;background-size:contain;box-shadow:inset 0 0 1px 0 rgba(0, 0, 0, .35), 0 1px 3px 0 rgba(0, 0, 0, .4);height:100%}.ogRouteMapContainer{margin:0 auto;overflow:hidden;position:relative;text-align:center}.ogRouteMapContainer .endpoint{position:absolute}.ogRouteMapContainer .endpoint.hidden{display:none}.ogRouteMapContainer .endpoint.container{height:15px;width:15px}.android .profileMapTile{box-shadow:none}.profileMapContainer .mapCallout{display:block;margin-top:-88px;pointer-events:none;position:relative}.profileMapContainer .label{background-color:#fff;border-radius:3px;box-shadow:0 2px 4px rgba(0, 0, 0, .4), 0 0 1px rgba(0, 0, 0, .4);color:#7f848c;display:inline-block;font-weight:bold;margin:0 auto;overflow:hidden;padding:8px 8px;pointer-events:auto;text-overflow:ellipsis;word-wrap:normal;white-space:nowrap}.profileMapContainer

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Optimum-Logo[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 900x900, frames 3
Category:	downloaded
Size (bytes):	36205
Entropy (8bit):	7.744576566667656
Encrypted:	false
SSDEEP:	384:bd+QE/pDU6XlOp7fxgKYfkpcw5+cUc76DvzeTeNAzBt/DXCYJHkopqAQhKw9vdyA:b0hD2sfkiwUcUccz5AzBZCwHkoYKjqSM
MD5:	0C791876FCF8E5CD12D43DC92B04D457
SHA1:	41CDD8CA45C2B446A140B303B9D0B6DE0FA41831
SHA-256:	31DEFC00002443526ED09AA74866EE1DA9D91CC7CF5E4649950C4D3520892511
SHA-512:	FD806F2A6C99AF65793A8A8FDE6A4113129D72A905F67DB1DCBCE9770EB72700CB2EDA61A827CB4C2C349291AEC3F7DA75A70F3B5C42C86B97B7520C3054275C
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.theragcompany.de/wp-content/uploads/2020/05/Optimum-Logo.jpg
Preview:	......JFIF.............C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$..........."...............................................................................@.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................-.E.Ok.F.....kucen.O...H.Z ..%...X"}..T7.......Y

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\PayPal-Logo-e1595003724191[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 200 x 61, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	3592
Entropy (8bit):	7.887604718879254
Encrypted:	false
SSDEEP:	96:aWKNMMhHey2mZNgZuRp6RvKySQUmK/i5N2xi101lD:FKOm+y28UmEvBDxcuoou1lD
MD5:	369823A00247703C3C7291001FAE4F7F
SHA1:	EB5D0538494EF395B97F99F0988E2D215799CBF8
SHA-256:	F52DBAB1C9C9F1522BFD06262D5A7C09802E320EA6E051A85F1C6A782EF96E37
SHA-512:	B766EFE3C46D04F5EC94CCBD810E0F26CD11F8211F319AEFD735E028FCD5AD6FBC020FA56B17E1CD99A9E3EF6E4C4A266DFF74EE53F9AA3E3F1B372583AA53FF
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.theragcompany.de/wp-content/uploads/2020/06/PayPal-Logo-e1595003724191.png
Preview:	.PNG........IHDR.......=.............pHYs..........+......PLTEGpLy..Ac.1...8..;.]...............;.....0T..D..;....+........'M..9.5X..<.Yu.+.....g...B.T.........@..9.....R..@..;.....C..B..B..9.J...:....Qo..?..:.....=.%K..>.7..Ab.j......=..E...................$J....8[.!...>.9\..9........B....0..O..F.......-R.....F.............%K..A. ......D.....A.?........'M.P..E.,Q...........<........>..........Nl..A..E.....@..>..?.Nm.'M.Gg.......Pn.....@..F...........D./..Nl....d~..C........8."I..C..?.%L..A...."H..C..=.Gf.....F.E...F.Bc..B..F.....=...........@.....@..=.,Q."...=..C..@...........>..C.&L..B....x......>.................?.:\.#I.!H.r...9.....?..B....*P..............8..7...........7..7..8..8..(f.7..)g.8..)g.(f.)f.:..5}.8..)f.(g.3q....)h./s..o....+j.6..3{....Y.....x..+l.E..P..1w.V..t..e..S..C..1p..........X.....h..>.....:xv8;.....tRNS.............V.V.l.x.L.)..-I...VM...7......l........S.. .k....1.P..(.#......:v.CB.e...N.+.o8...PEHk3g`..6W..n........I..}..\..}!.F.yT..W..b.^s....a.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\S6u9w4BMUTPHh7USSwiPHw[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 30024, version 1.1
Category:	downloaded
Size (bytes):	30024
Entropy (8bit):	7.98341417708702
Encrypted:	false
SSDEEP:	768:Bxk6hFMXBOJ5Wuln1Hczrm+CwYHAtP9BN6abu5oHhDxht4JwhJzcja7:BxSBOJ5DlnqbCwSAtPHnNHmwhJzcja7
MD5:	656963C4BEB814E754E38478FCAA0439
SHA1:	B316CB67F50354A2B934C51E7EB86D003F4E9E39
SHA-256:	0BD12C73F8DBABEAB3E723111D08140CDDED5C22BA6AFACA174373A72A819DA2
SHA-512:	72EF110C286D22F2D8EA0C790704DBC236E9BE81D939C4A039A59C9612D1E61989168163E475C1439A6E93A097AEF9761A42A7983062BCE36FE60253ECD5294B
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/lato/v17/S6u9w4BMUTPHh7USSwiPHw.woff
Preview:	wOFF......uH................................GPOS...........z.4..GSUB...x...S...p.:.\|OS/2.......[...`x._.VDMX...(........s.z.cmap...X...........cvt ................fpgm...........s.Y.7gasp............."..glyf......S....P....hdmx..c....6......A.head..m....6...6.O..hhea..n........$.i.>hmtx..n$.......vkh`.loca..p8.........2..maxp..q.... ... ....name..r....;....<.RNpost..sX.......EW..Dprep..t....\...r_.78x.T..l Q.EO....m.m.m;X...Fl..?us..p.$z3......G.f.N...`Yv...p.a.N.*."b.3...]p..`...l,.5...]=.%U..D...[)v?.xX.w...;.w>.....mt?....+......]..G.>]:(.JO.+.J.R.=.k.....@9.+........:(.UP.k.bZ...B..a....U....6\..Q.10....H'...../.....1.!.e....HF1..Lf...l.0.y,`.KY.rV....b7{....p...,.8...r.+..>.x.#....%.x.[...\|.....7.._.........$.H..&.X.'.D.I!.^xX7..=..........{X=.h.aRE.u...y...+4.6vW[.B......D0.55..&..ug.5...r(.h.Q9..r..W.!.[.0;..G.......H[..P.G)G.....m..c....}....'=\p."..dL^.W..>qf.e.y...v...$Iq_...%G....{.#.STw`.G.<.....j9e.OG..N...!.(4.L...EW../...C{.Z.P.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\S6uyw4BMUTPHjx4wWA[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 28660, version 1.1
Category:	downloaded
Size (bytes):	28660
Entropy (8bit):	7.986798426962959
Encrypted:	false
SSDEEP:	768:Rr8uuUMtVCqVsUnrZAT9vaxw9pi95vSVc+Dfpy:R9uZV9VnndAJvaCGPvwDhy
MD5:	B8EE546ACD6CC0C49F42AD3D48EF244F
SHA1:	7D8BFF4143A36AA9CC1C2801F60FA0E99969E3F6
SHA-256:	04050BAE4CC3B9CCD20D3C7F57F5B1BA249D4A54D6EFF75A1E4DF504362E8C00
SHA-512:	700D04F4CAF24A20919C2136DD3700BBE07F509F5BD0045084063B78EA8B6FD72BFEA6BBF2A94A5865A75CD6C7197DAB500B809122AA5A3910F46E1D9816D00C
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/lato/v17/S6uyw4BMUTPHjx4wWA.woff
Preview:	wOFF......o........l........................GPOS...l.......z....GSUB...<...S...p.:.\|OS/2.......Z...`y$aycmap...............cvt ...x...+........fpgm............rZr@gasp...$............glyf...0..YY...H@...head..h....6...6...#hhea..h........$...whmtx..h........v}.O7loca..j............9maxp..l.... ... ....name..l....8....:.TApost..n........EW..xprep..o....K...K....x.T..l Q.EO....m.m.m;X...Fl..?us..p.$z3......G.f.N...`Yv...p.a.N.."b.3...]p..`...l,.5...]=.%U..D...[)v?.xX.w...;.w>.....mt?....+......]..G.>]:(.JO.+.J.R.=.k.....@9.+........:(.UP.k.bZ...B..a....U....6\..Q.10....H'...../.....1.!.e....HF1..Lf...l.0.y,`.KY.rV....b7{....p...,.8...r.+..>.x.#....%.x.[...\|.....7.._.........$.H..&.X.'.D.I!.^xX...=..........{XC.hySQy....p...n)..h..M.(..f)"..)..j...L.qw..R`).E..8..1.X..7...\..9(q(..32.PJ)K).....#)I(.X...{.....7.g..\s.:..7dL...K.>..0H.!.Y.v.U.Xg...m.-..a.=.:...<!..c.9~....?B...w...-..l(.>..TQM...X..5...G.J..P.\..=4.H31Z....q.j.6........v.#..z.G..e.q

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\TheRagCompanyFavicon[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 512 x 512, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	24080
Entropy (8bit):	7.950651221827242
Encrypted:	false
SSDEEP:	384:7tCyaDb59rK1wZ7wuIRp6lbmmUCRrWHZqxi4tclkcfbDc1Vt91m+s+zuuv:7t6pI1w1wuIWlbLZUqc4tlcfbI3Fm+X7
MD5:	F4A5EA80E2436F82ED1F1AE3B774300B
SHA1:	4977DD9340154050699C47E6A0AA0571C92D5626
SHA-256:	B6CB3EEFF07DA5181BA5A1E1F90FA944EF2D9A2BD992FE89B43BCF05A66B57D2
SHA-512:	43F295100B31AD3CF3C8E61D5D288BC53E16B457829255D2171040BB69969997E1EDDEB5C727DA8C29A66197A952D553A1095BDEA7A505637582DF9DFF070A77
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.theragcompany.de/wp-content/uploads/2020/05/TheRagCompanyFavicon.png
Preview:	.PNG........IHDR..............$.....gAMA......a.....sRGB.........pHYs..........+......tEXtSoftware.www.inkscape.org..<.....PLTEGpL...........................................................................................................................KKM......""$\\^SSU...iik................................................_..Z..f.....t.....i.....p.................)..............0..l.....;..V..Q...........4..A.....K..........!..."#%...STV...&........ffi...b..FGI...+,................{..>.....m..X..pqs..........E.....ABDN......"....679........'...&(/02=>@......#.......'6.,=...d.............\^`............XY[klnz{}abd.........JKN236NOQ..../C...........w..9:=.<U.4I8..tuw....o..C`......~.........Ih.Rt-..H.....\..~..wxz.8N.V\|.q..\..v.....f....S...z.....a..BX.j..On..$.......9G'I[.x....v.........(2.p..f..`....Gy.%..4Xl...v..`..Cm.p....M...m.m..j.....:awB..V..O..]..P..7..B........$...S/....2tRNS...+..".....K......T.....k.@.\..s.39.d.y.............. .IDATx..IO.j...gN.<.$.....k.M*..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\VGLH3wFQwXv[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	18633
Entropy (8bit):	5.377159971391303
Encrypted:	false
SSDEEP:	384:09NqrxrGl0tftzcfOZZKPcPFuDpDPF0EE8M:09NqrxylEtzcfOZZKP2FqVfM
MD5:	9787128F3C1E7838DC3FC85692280975
SHA1:	87E06E6E9E8A79A0A1C9C824AC553549E93E3E0F
SHA-256:	DC52D6F899419EACD6E5492AEADB7193627ACC71D6046EC7E905424AEA15AD0D
SHA-512:	688109CAC9A2A6839889BDA22A2FACA49274973C0EC10CBBEA62C305187975061272E7067DA02229B17AA3338216DE6D4502F2EACA9B3112C08BDADB6A336103
Malicious:	false
Reputation:	low
Preview:	._-j7{background-color:#fff;left:0;padding:8px;right:0;text-align:center}._-j8,._-j9,._6o5v{background-color:#fff;padding:0 4px}._-j9{width:38px}._6o5v{width:calc(16.67% - 7px)}._6o5v:last-child ._14bx,._-j9:last-child ._14bx{background-color:#fff}._6o5v:last-child ._6z-0 ._14bx,._-j9:last-child ._6z-0 ._14bx{background-color:#ebedf0}._-jx{border:1px solid #ced0d4;left:0;position:fixed;right:0;transition:bottom .5s;z-index:100}._-jy{bottom:-52px}._-k3 ._5m_t{position:fixed;transition:bottom .3s}._-k4{background-color:#fff;border-radius:4px;border-top:1px solid #ced0d4;left:0;right:0;transition:bottom .3s;z-index:104}._36bl ._2x1r,._36bl ._2thz{align-items:center;background-color:#3578e5;border:1px solid #3578e5;border-radius:4px;color:#fff;display:flex;font-weight:500;height:34px;justify-content:center;line-height:16px}._36bl ._2ti7{margin-right:8px}._36bl ._2ti7 .img{height:16px;width:16px}._36bn ._14bx{align-items:center;background-color:#3578e5;border:1px solid #3578e5;border-radius

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\_6QbEglrVsx[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	341
Entropy (8bit):	6.306829184804613
Encrypted:	false
SSDEEP:	6:6v/lhPO67CUyKO/cqK91l1E7G/HFiEKVKbbFyzgN+thoHaNIEM5hoHYjp:6v/7P+U51wK/li2tyzS+royIEM/oq
MD5:	5DE8E84774B60E2CD6FFD4A36B9D7843
SHA1:	D54859428BD20AE2C2F284D9317BE88F0074430A
SHA-256:	336C68D6C9A6D8B18422F23F9B95C836AC7FB496709913D5934D44E21C5CE126
SHA-512:	F7602EB9CE51C8FA71B24B60FD9600B536DB8435248A085EA40F7138AC47AFE1E40EFDD8BB610D18725B680AE09634C0C5E755B27B34880EFE41845B04D94543
Malicious:	false
Reputation:	low
IE Cache URL:	https://static.xx.fbcdn.net/rsrc.php/v3/yV/r/_6QbEglrVsx.png
Preview:	.PNG........IHDR...............7.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....$.......]IDAT(.....P.C.b.;.....i..8.....9..._X.4!.8.\|............ #.'.`.....h.qx?.wRU....fy.....s...>.'9.......%tEXtdate:create.2019-02-12T15:36:01-08:00..q....%tEXtdate:modify.2019-02-12T15:36:01-08:00p.......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\base[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	1583075
Entropy (8bit):	5.572010630605882
Encrypted:	false
SSDEEP:	12288:dQZjbUXG79OvsJP5s8RmUTz1Ua1e7VvrtfEbgSHgCtbnEG:dQhUGOvsJBs8wUTxUie9pckwfEG
MD5:	2E7346E355F1FD09F549DFDE3E49A11D
SHA1:	DA9404DAA8E83156980ABC3034CAEA79435E96A1
SHA-256:	3995CF4A71263D70B3354ACF1C649038C18EAF289E4287B8CB8E2063DF5F2901
SHA-512:	1C7F273C74C34154CA3CEC3F98AC789EBCF58EC9F154FF77EBDFDA866F176E67D7CC14A3576C4B14E671DC4564D88DC66CF5CBF3E7E8BA60F768645FB83EA792
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.youtube.com/s/player/5a096a9f/player_ias.vflset/en_US/base.js
Preview:	var _yt_player={};(function(g){var window=this;/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var ba,da,eaa,ha,ia,ka,pa,qa,ra,v,sa,ta,ua,faa,gaa,va,wa,haa,z,xa,ya,za,Ba,Ca,Ga,Ea,Ja,Ka,kaa,laa,Sa,Ta,Ua,maa,naa,Va,oaa,Wa,Xa,paa,qaa,Za,fb,raa,ob,pb,saa,ub,rb,taa,sb,uaa,vaa,waa,Cb,Eb,Fb,Ib,Kb,Lb,Ob,Vb,Xb,$b,ac,ec,gc,hc,zaa,ic,kc,lc,tc,uc,wc,Bc,Hc,Ic,Mc,Kc,Daa,Gaa,Haa,Iaa,Qc,Rc,Wc,Sc,Yc,ad,Jaa,Kaa,$c,Laa,gd,hd,id,jd,md,nd,od,pd,Naa,qd,rd,vd,wd,xd,yd,zd,Dd,Ed,Fd,Hd,Jd,Kd,Md,Nd,Od,Paa,Pd,Qd,Rd,Sd,Ud,Vd,be,de,ge,me,ne,se,te,we,ue,ye,Be,Ae,ze,Uaa,ie,Ne,Le,Me,Pe,Oe,he,Qe,E,Waa,Ue,We,Te,Ye,Ze,$e,af,.bf,gf,hf,jf,Xaa,qf,mf,Cf,Yaa,Gf,If,Nf,Of,Pf,Qf,Rf,Tf,Sf,Uf,Vf,aba,cba,dba,fba,Xf,Yf,Zf,ag,bg,cg,eg,dg,hba,gba,gg,hg,iba,ig,jba,jg,kba,kg,mg,og,wg,xg,Ag,lba,Dg,Cg,Eg,mba,Mg,nba,Ng,Pg,Qg,Rg,Sg,Tg,oba,Ug,Vg,Wg,Xg,Yg,Zg,$g,pba,ah,bh,ch,qba,rba,dh,fh,eh,hh,ih,lh,jh,tba,kh,mh,vba,uba,wba,ph,xba,rh,vh,wh,qh,xh,yba,yh,zba,Aba,Bh,Cba,Ch,Dh,Eh,Dba,Gh,Ih,Lh,Oh,Qh,Nh,Mh,Rh,Eba

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\c3MVRnq44b4[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	38502
Entropy (8bit):	5.499427572288581
Encrypted:	false
SSDEEP:	384:jywzIoAcMI6sIu+p2fNkvtT5ZJWCkqogynHPEdav6EfolV25qhDTtUqgdobI1Cp4:mwzxHMiIJhddxfEsLixxcwTiY
MD5:	30F3C8E83D843230F5BA747133AA7E5E
SHA1:	550F5C827F1C30CE29E35FFC846DAE5859B4A361
SHA-256:	0421F50F7D355C1EEAB78F5A3B09BB7C6379D5016C2CF257A13A049F6E67A7F3
SHA-512:	C1854D1DFD5D1A1EFA44BD13021EF0F748A2BA5127973D0CE6852F6AD8515E369CE4A4C011ED8109E8F9996B99C4EBCC8649892E944D627113248CB0D5DC1B34
Malicious:	false
Reputation:	low
Preview:	.wp.touch._fzu .storyStream>.carded,.wp.touch._fzu .storyStream>article>.carded,.wp.touch._fzu .storyStream>div>.carded,.android.touch._fzu .storyStream>.carded,.android.touch._fzu .storyStream>article>.carded,.android.touch._fzu .storyStream>div>.carded,.wp.touch._fzu .groupChromeView.feedRevamp .carded,.android.touch._fzu .groupChromeView.feedRevamp .carded{border:1px solid #bdbebf;border-image:none}.touch._fzu .storyStream>.carded,.touch._fzu .storyStream>.carded:first-child,.touch._fzu .storyStream>article>.carded,.touch._fzu .storyStream>div>.carded,.touch._fzu .groupChromeView.feedRevamp .carded{border-image:url(/rsrc.php/v3/yN/r/QmGuax92JQa.png) 4 4 6 repeat;border-width:4px 4px 6px;margin:0 8px 9px}.touch._fzu .storyStream>.carded._29d0{border:0 none;margin:0 0 8px;overflow:hidden;padding:16px}.touch._fzu .storyStream>.carded._29d0._122m{padding:10px 10px 0}.touch._fzu .groupChromeView.feedRevamp .carded.groupHeader{margin:10px 8px}.x2.touch._fzu .storyStream>.carded,.x2.touch.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\ce36b733f814[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 182 x 182, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	10516
Entropy (8bit):	7.965643531331271
Encrypted:	false
SSDEEP:	192:k6lJHe9aIU/9u7c2wG0M4pjY1/r+v8yG+VU0Zf14C3nz/pyleZ:Bre9aI4kj0k1JyGD09l3nrV
MD5:	3A0C602F4DE5799987CB44FE8D538313
SHA1:	58FC019B24977ED9C9C738C132BB4489F60B4CC3
SHA-256:	E88EC93E4FDE13246F3FCED3AD0D534FA60866DBBF466DF7BEEA56B6A72E5356
SHA-512:	2B59993770D78D29996841B09C15F79D781A8A52F30B65D7EF629A55B8D2A1FCD561206947ED6DC269A1620B5D167A7E22ACE1F5CAA8C8F2BE61389D1F9CE46D
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.instagram.com/static/bundles/metro/sprite_stories_ce36b733f814.png/ce36b733f814.png
Preview:	.PNG........IHDR...................(.IDATx..y\|T....!...3.=.d%.Y........,bq% .P...Q......m.Ulk..1H.V..W.[.....UT.E.BdI8....c..5!..s?..9......Y..z e)KY.R.......T..no.CH'...r. .t....@...}%.......r..(0..E..S..'..d0D.~ d.O.%.PD>vt.".;..[i....-.......<...s...-.....$...}..X2K.;...o..}x...;'....?.....U....3...>{c........2.m.i...{....S.G.Z0e..............J....w.R........C;D.;.c..8Q&.;...f.w:...a....3V.)...E.[...f.V?.o..j....K.q{!g....!.c.Br.a'.......:E=..1.G..=z..0.....u.G.........#Fl.S..#FL.&...9.e.I$`.......l.d.S......#z.d=..8(..l..p...}.o.cK.....#FJ>...'(..0.4.HG.}..#.A.......U..kfcGIzLJ.m.-....O..tr.c.F..9_>{x...1`..w..m.LK..L.w_..n=..d.\(..-?&.......V.U...H..v.I..f..^.jgV-......T.~..5....6`........#...c.......Z..k..#....Ws..Y.E.W..XO.q.m .......5..G..no.*._\..#G...t1..T...}..d..A..?.X.\s.ME.....C.kN.6..?~.0c.......o.."..D.}..if:M.g<ML.y._..n-Z.../...x.E..cD/.M...Z.....p2_.s9s..H.......U....N.".......A...z..=G..b..L..%

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\default-skin[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 264 x 88, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	547
Entropy (8bit):	7.404434668199683
Encrypted:	false
SSDEEP:	12:6v/7roqlEUceTBnKUxtiOap6etrKwM+TdulV4gY0ch8z:LJ4BK3Oap1tGb+Td4SG5z
MD5:	E3F799C6DEC9AF194C86DECDF7392405
SHA1:	ED95A8E40A2C3478C5915376ACB8E5F33677F24D
SHA-256:	FD2D3FED8D73FB4A3265475C444817343F3383348C254428F85E7B4B076C7DCF
SHA-512:	F0F7B5FE9BF815A08CA748F4533E8C016909643A12D4EF49552024EECC787158C479D8CCDDA7AAC195094ADCDE372899D5B1066A56DDE53FCB4D1D7831E68037
Malicious:	false
Reputation:	low
IE Cache URL:	https://theragcompany.de/wp-content/themes/woodmart/images/default-skin.png
Preview:	.PNG........IHDR.......X........7....IDATx...jTA...$j\|.k..V.l#...Oa.[..".. l...Z.e.p.AL.....8..k.{`......\|E.rv.,).$I.$I.$I.$.....l.>....1p.K.f%4...B..)0..%#p.A...v..Lh..glXpX.Y...\......x[~..8!?....1..).w..J.27D....y<.O.v.."W....O..n3W..Y&M....C.Ig..3D....5...`VBK.Y,D.=.....6PBk..\L..Fq..(X~n...c...;....c!.P....~.$I.$I.$I.$I.$I.$IRK...P.JJ...4Y..`%.C...bn{..?....r..O.#..T......].J...yB..TI...\|..b..@..dx.......u....Ut...->Y.?2.......}.......nt..vr........`1.].q.KO.k^..E=........A.y.$I.$I.$I.$i.~.Kh3.2.q[....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\detail-factory-brushes-black-2-pack-main__55258.1564607733-600x600[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 600x600, frames 3
Category:	downloaded
Size (bytes):	12100
Entropy (8bit):	7.65277517158011
Encrypted:	false
SSDEEP:	192:MmgcHOSVIehyJTLcc0AXK14uiMHFU1svdx4R7n7WpzzAXYGx+BiBwB/VrwC:J7H3qJHctkK14F1svdeRT7CzEXYzfB9d
MD5:	60A1869A714C8F7E62CEA48A2FF605F2
SHA1:	1DEE9043A50CE5225094C2840A0B34A46D67C821
SHA-256:	EB1F7CFD6E43A7914F01EAC3D6FB1300352922711858FBC4A2C117EDC5B29094
SHA-512:	343E07B0EBB88EC2358B4A7F1B461B9E91C9D3ED907ADE04C7A2F1D43EBE74EF922036559DF0D290D0108FC23E7957BD740AA1E2692628B8DD50E35E40C76B18
Malicious:	false
Reputation:	low
IE Cache URL:	https://theragcompany.de/wp-content/uploads/2020/12/detail-factory-brushes-black-2-pack-main__55258.1564607733-600x600.jpg
Preview:	......JFIF.............C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$......X.X.."...........................................................................0.@....................@.......@.(.....R..!H(J.....(J".BXR..!HR........@............................@...................................................@...........`X..................@......(@...`X.................@......(@...`X..................@.....K(J@........................(J............................(K(.....(......................A(K(JJ.J...@.....................(J......(......................@.(.....@...................9...C.........(......................*.g.u.=.......]7....(.%....................i.:g\=[..^$....27\|..$3..i<...^T.=..v...$..'....9#..9.P.%... ..........`f.D..;.8s...H...D.e1.s..G@.[.:.k.6..j.@..97..........l9.a.....%.B(.........+..G.\|.......gp...Y.^[..j..C..v......oo....%.3^...h.....G..G......1.m5..8....r.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\efef-600x600[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 600x600, frames 3
Category:	downloaded
Size (bytes):	38679
Entropy (8bit):	7.96254002446005
Encrypted:	false
SSDEEP:	768:9B1E12DPV9fDKbNHQIs+gHrO21n8znJOtQzShVdT0bYNu7msEiPo:7WC/ubNrspLl8znJOtqShVd+Y4mspA
MD5:	E3250C998A676D26AB2557ABA78C81FB
SHA1:	73AEA259E25579519611E1A9D1EE07B36C98C63F
SHA-256:	BCE073E16382071C0C727ED346126FB5F9204C924A6EEBB747F5351F3AD8A06E
SHA-512:	28D0F238E7992F0402933453BAFD70E36F3BE25452C6594E13336E13B87352600E8A1AA6066062E65ACF5CE295FF0118D5ED3883FF1280B385D50C59BE374D6F
Malicious:	false
Reputation:	low
IE Cache URL:	https://theragcompany.de/wp-content/uploads/2020/12/efef-600x600.jpg
Preview:	......JFIF.............C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$......X.X.."..............................................................................F.....5...N}=J.{...r4t........6s/:..\..WN{o...\|..6.....3Kn.U..oW..t..fu...8......V_N...x.Vr.....s..5.Snm...OS5...]".(.%..+[lx._C4.u6.$.%.A..o:6.,N.'8.95..4.tk..zt0.s.vsv...].J.f.u....^....l.h.p....e;.@.W.D..6n.&[.Z.n.G'.j...%.Z...Y..q..z.......U.sf.L.k.]{...^.:pk...2......s.\7t7&..8.n.gb..g..K....`..^..OZ.pN...E.7.[..m..0.R^..5e....~xj%B.Xhc..z......#.n.<....U......dL......y.0.!R.B........\5....)\|.....1...s..a..9.[..I;.z..k;=:.&\.k.j..c.f...x.5......."..n..\.T...UX....F.Yb......{/w..g...o-u.(.)....*n...Rn.:..l...3:.....M..Ze.5....4....mT.5..q.....\..B.Q9...9./I..v.Q.......YRY.>....^.g?...q:...]59...#OP.]/m..t....t.^h...Se.V..Z3y.NhI.4....M.=....Wa%...).X.[g7.e..r..c.gj.<.Am....c;e..I...+.#...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\en.089031c5[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	168787
Entropy (8bit):	5.158582460857807
Encrypted:	false
SSDEEP:	3072:Q6I7xn4HUQXIakxjWg4bJLhMTmlkZY2dT:E+HUWbYjf
MD5:	5F4C475214A0651239B3400B55690C70
SHA1:	C6580EAC13AEE87F43263D5499F6C304C8A82FFB
SHA-256:	6095DDDFDB0E3E476368D19ADB758F8E42C73868469BE297EFB270863F43A863
SHA-512:	0684FEDF99E887717A3BBBDDE1E158CD4705EDF3CBD8E137BAF3B22B07AC3908F5D00347DDCF1FB6894E2B3BF1C7C6271DE6AB87FED9E4F428B19BF5A12CBF62
Malicious:	false
Reputation:	low
IE Cache URL:	https://abs.twimg.com/responsive-web/client-web-legacy/i18n/en.089031c5.js
Preview:	window.__SCRIPTS_LOADED__["vendors~main"]&&((window.webpackJsonp=window.webpackJsonp\|\|[]).push([[101],{fRV1:function(e,t){var o;o=function(){return this}();try{o=o\|\|new Function("return this")()}catch(n){"object"==typeof window&&(o=window)}e.exports=o},oTxr:function(e,t,o){"use strict";var n=o("3XMw")._register("en",{get emoji(){return o.e(242).then(o.t.bind(null,"oFUs",7))}});function a(e,t,o){switch(n=e,a=!String(n).split(".")[1],1==n&&a?"one":"other"){case"one":return t;default:return o}var n,a}n("ed617674","360"),n("e23b20af","Cancel"),n("a620fcff","Loading image"),n("e9e2064c","Something went wrong, but don.t fret . it.s not your fault."),n("d7060c8f","Refresh"),n("a0493513","Retry"),n("b4f19b96",(function(e){return e.listItem1+" and "+e.listItem2})),n("i0135403",(function(e){return e.listItem1+", "+e.listItem2})),n("f1574a4a",(function(e){return e.listItem1+", and "+e.listItem2})),n("b74bf8b7","Image"),n("a7cd5cf4","Video"),n("df8cd2af",(function(e){return"Slide "+e.current

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\fa-brands-400[1].eot Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Embedded OpenType (EOT), Font Awesome 5 Brands Regular family
Category:	downloaded
Size (bytes):	130906
Entropy (8bit):	6.2663918957688916
Encrypted:	false
SSDEEP:	3072:ID7WRC3JMtlRcn2tZ+8b6I9xevNGiPWkWvLu:IX3JMtjVtMGxeFPPWvzu
MD5:	33D922B1F01EDB0ED591830BF8EBF899
SHA1:	C46EADFCAD15F35158739AA031F9F22075AB1CCE
SHA-256:	1FA081311E54ACD02474B5C1AB393EA9BC96FDB9F848D974F655036F31ED9B84
SHA-512:	77CE7371BEA5634C366A89051F0417DC3D80375510627F8E4F5722A711C6B5C2A57B95C060B1C27FF4DBA45B09623B87891990684C5BFB46E33C98F955DAA9E2
Malicious:	false
Reputation:	low
IE Cache URL:	https://theragcompany.de/wp-content/plugins/js_composer/assets/lib/bower/font-awesome/webfonts/fa-brands-400.eot?
Preview:	Z...(.............................LP..........................V...................:.F.o.n.t. .A.w.e.s.o.m.e. .5. .B.r.a.n.d.s. .R.e.g.u.l.a.r.....R.e.g.u.l.a.r...L.3.3.0...4.9.8. .(.F.o.n.t. .A.w.e.s.o.m.e. .v.e.r.s.i.o.n.:. .5...1.1...2.)...:.F.o.n.t. .A.w.e.s.o.m.e. .5. .B.r.a.n.d.s. .R.e.g.u.l.a.r................PFFTM...........GDEF.*..........OS/2B..8...X...`cmap.r..........gasp............glyf.o.........lhead.9-........6hhea.6.........$hmtx@c.C........loca.`\|^...<...jmaxp...O...8... name............postV.I.......G.....J.\|.V.._.<..................................................................................L.'...............@.................L.f...G.L.f....................................PfEd...............T.........:..... ...................................................................................@...................................@................. .............p...........@.......................................................................@..... .....@........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\fa-solid-900[1].eot Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Embedded OpenType (EOT), Font Awesome 5 Free Solid family
Category:	downloaded
Size (bytes):	192758
Entropy (8bit):	6.349432274438151
Encrypted:	false
SSDEEP:	3072:LPtAtFnhbTO7jZUpLL1C5vPXiazQXYtvyVaaKL+jr0hFlx5P+hehAMe9Z:LtAtFnhqyp9CFXiMQItvyQMjYhFH5iMk
MD5:	6E27A27923619B30FC089BD0B84E4685
SHA1:	2B3A98E7399FEA366879EECCCB59FCF3F2B7AAD6
SHA-256:	E2309AD95A8F3BBFE7E977AF8FFEB8DE2CE6F7714FDE2EA74E1528356EEF4FB9
SHA-512:	31B7EC2CF8968681E5DEF41724E61DB6B10549EDC738764FE76B31F27E3C28913D02E3C4E00D1AA2EBCD76CCE3CBF8AE422D97CEE738BA2525BDEAC01C21F8F7
Malicious:	false
Reputation:	low
IE Cache URL:	https://theragcompany.de/wp-content/plugins/js_composer/assets/lib/bower/font-awesome/webfonts/fa-solid-900.eot?
Preview:	..................................LP........................!.\|...................2.F.o.n.t. .A.w.e.s.o.m.e. .5. .F.r.e.e. .S.o.l.i.d.....S.o.l.i.d...L.3.3.0...4.9.8. .(.F.o.n.t. .A.w.e.s.o.m.e. .v.e.r.s.i.o.n.:. .5...1.1...2.)...2.F.o.n.t. .A.w.e.s.o.m.e. .5. .F.r.e.e. .S.o.l.i.d................PFFTM..........GDEF..........OS/2C..8...X...`cmap$/.........gasp...........glyfT.....+`....head.G-........6hhea.C.........$hmtxil..........loca.nF....P....maxp.%.S...8... name$.&,...\|...+post...1.............J.\|.\|.!_.<..................................................................................P. ...............@.................L.f...G.L.f....................................PfEd...............T.........:..... ...............................@...........................`.......................@.......@.......@...................................@...........................................@...@...................................@...............`...@.....@..............................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\fa-solid-900[2].eot Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Embedded OpenType (EOT), Font Awesome 5 Free Solid family
Category:	downloaded
Size (bytes):	192758
Entropy (8bit):	6.349432274438151
Encrypted:	false
SSDEEP:	3072:LPtAtFnhbTO7jZUpLL1C5vPXiazQXYtvyVaaKL+jr0hFlx5P+hehAMe9Z:LtAtFnhqyp9CFXiMQItvyQMjYhFH5iMk
MD5:	6E27A27923619B30FC089BD0B84E4685
SHA1:	2B3A98E7399FEA366879EECCCB59FCF3F2B7AAD6
SHA-256:	E2309AD95A8F3BBFE7E977AF8FFEB8DE2CE6F7714FDE2EA74E1528356EEF4FB9
SHA-512:	31B7EC2CF8968681E5DEF41724E61DB6B10549EDC738764FE76B31F27E3C28913D02E3C4E00D1AA2EBCD76CCE3CBF8AE422D97CEE738BA2525BDEAC01C21F8F7
Malicious:	false
Reputation:	low
IE Cache URL:	https://theragcompany.de/wp-content/plugins/js_composer/assets/lib/bower/font-awesome/webfonts/fa-solid-900.eot
Preview:	..................................LP........................!.\|...................2.F.o.n.t. .A.w.e.s.o.m.e. .5. .F.r.e.e. .S.o.l.i.d.....S.o.l.i.d...L.3.3.0...4.9.8. .(.F.o.n.t. .A.w.e.s.o.m.e. .v.e.r.s.i.o.n.:. .5...1.1...2.)...2.F.o.n.t. .A.w.e.s.o.m.e. .5. .F.r.e.e. .S.o.l.i.d................PFFTM..........GDEF..........OS/2C..8...X...`cmap$/.........gasp...........glyfT.....+`....head.G-........6hhea.C.........$hmtxil..........loca.nF....P....maxp.%.S...8... name$.&,...\|...+post...1.............J.\|.\|.!_.<..................................................................................P. ...............@.................L.f...G.L.f....................................PfEd...............T.........:..... ...............................@...........................`.......................@.......@.......@...................................@...........................................@...@...................................@...............`...@.....@..............................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\fetch-polyfill[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Pascal source, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	8543
Entropy (8bit):	5.238064281324506
Encrypted:	false
SSDEEP:	192:oQHdiEslZc0rsNYNU5mSJHqI03aej6tZoaMLQO/x5/P80+HcW:ocHslLsP5muHqI0Jj6tZcUO/x5+V
MD5:	04E3CC8A9641B3F9F9C9370F4E9B5BDD
SHA1:	9602A891F583094BB04FD407B253ABCAFFB8C8D0
SHA-256:	DE6C4FFA2BD9FD283610E28D0DB2EC48607AAB39D213A51AEF248673A0A7E980
SHA-512:	58942BCC0F39D620A475B65C1AEB4F18872F68F22C89DEC076906A0DB8BC2B7CCA9357710A7824A0FA7404FF73F41013AECA34609CAACD2187414F7BD0D490D6
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.youtube.com/s/player/5a096a9f/fetch-polyfill.vflset/fetch-polyfill.js
Preview:	/*.. Copyright (c) 2014-2016 GitHub, Inc... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. "Software"), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be. included in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE. LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION. OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\hkKvKo6GByt[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	19395
Entropy (8bit):	5.319668039352318
Encrypted:	false
SSDEEP:	384:1yB9Vg7/ELuB3+guBusQAV4wTBcjlBXhLqcwkNE+Pbh+f:1CVg7/MuB3+guAsNVNlcjlBX9xN1PUf
MD5:	1F3FA1774E7543575C3F8BB7463B7C59
SHA1:	FFBE86F94B7771D0B869E9DD0509D414B88DCFE0
SHA-256:	6606B70C66E660222D726E3DA99EADC6703253FA33D13F96E1484107DDA9429D
SHA-512:	8B18A50A0440E4C6BD4AD3C6631F4951B3676533E00C65C4365AD6FF5673E7BEF356D48735D501DF299194EA8606FBBEDB57BC914D8C0372C2708AD71461820E
Malicious:	false
Reputation:	low
Preview:	.touch ._5ui2 ._5dpw{text-align:center}.touch ._5ui3{padding:6px}.touch ._44ii b,.touch ._44ii .sec{font-size:14px}..touch ._8x0i{border:none;border-radius:6px;box-sizing:border-box;display:block;font-size:15px;font-weight:bold;line-height:20px;min-height:36px;padding:8px 12px;position:relative;text-align:center;width:100%}.touch ._8x0i._8xqj{width:auto}.touch ._8x0i._9oix{width:100%}.touch ._8x0j{background-color:#1877f2;color:#fff}.touch ._8x0j:active{background-color:#216fdb;color:#ccd0d5}.touch ._8x0k{background-color:#e4e6eb;color:#050505}.touch ._8x0k:active{background-color:#cdced3;color:#050505}.touch ._9004{background-color:#e7f3ff;color:#1877f2}.touch ._9004:active{background-color:#cde5ff;color:#1877f2}.touch ._8x0i._8x0j:disabled,.touch ._8x0i._9004:disabled,.touch ._8x0i._8x0k:disabled,.touch ._8x0i._8x0j[disabled],.touch ._8x0i._9004[disabled],.touch ._8x0i._8x0k[disabled]{background-color:#e4e6eb;color:#bcc0c4}.touch ._9adg._8x0i._8x0j:disabled,.touch ._9adg._8x0i._8x0j[

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\iK-MULTI-PRO-2-DEMO-3-600x600[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 600x600, frames 3
Category:	downloaded
Size (bytes):	50364
Entropy (8bit):	7.97928670579534
Encrypted:	false
SSDEEP:	1536:Vb8RI9pdN+dxg3y3hgSMs7Du2Wu4TN8kyF4eN4kkh:Z8C9pdsdGC3CSMsHu22Okb3h
MD5:	141FE35AADD239AA85BFE45B9DB01939
SHA1:	53BBA1E97ADCF00111F3BBCB322D06FA578EEA10
SHA-256:	171D7CAC4B31F8A08165055EE09F150A42184C7E8EA83AB5D758177A54F084C8
SHA-512:	5142DD34D12056A14C5022529FF45DB416576BF4AD3431D2F83D6FBC7A6132BC0A517B66A656707CBCD141DD9A52643AF7AA8F6BF9F0BFA919C4683162EB950B
Malicious:	false
Reputation:	low
IE Cache URL:	https://theragcompany.de/wp-content/uploads/2020/05/iK-MULTI-PRO-2-DEMO-3-600x600.jpg
Preview:	......JFIF.............C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$......X.X.."................................................................................O...]....X...K^.qN...~.!.w.~......oY\|/....n.g8..N1..u.7\z.Q.=.=.....,....p.T.\,5B.\KBA.A....5.p.h.x.,5. ..Z.$O.A...Z.....+qk+p.......:.._...[...Vy.OI<.W~.;K.........nk.Q....t.L...%..0.K..D...Y..K..!..,.,...R.+...X.X.`....$<;#\|....w.d'Gun<.,...g....._..O..b...5...e..t...g.x.u..v.....P<.....N...i.yz3%._+`.A$Y...@"......R.R2..Q.(..%.4.M.x..Q..;b.k..d.Kff.z.=.......oN...7F>...+5.2-....6JB.....V.....r.....(cmr\.p.2.Q..f.[.r4[.. .h"4R.@....B...zvp5..z../...vg..vMi..=.].\.]vX.5...........v..-:.R/E..{+v...ej0.2.Y.Y.....T,..R.`Uq,j.#G+[...A^"G.fE......v.:.+....<..\|(.y;.?W...';......fR.^..m.]th......n.f/A..1..r..L.K..F4..Yr,.,H..cHX......(..F...P.+C.(..C....,.d..h.b..=...p...O..<.J>.._).W....I...9.\..;....y....-Z..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\iK-MULTI-PRO-2-MAIN-600x600[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 600x600, frames 3
Category:	downloaded
Size (bytes):	42228
Entropy (8bit):	7.966074383742412
Encrypted:	false
SSDEEP:	768:Mc9K+U3m5+qBjTtiJVkRmLMeOSoZX51G8QaJG5/fAVzurAME7ocD:M+lU3zcjTtifkRmYVZX5M8Q/szu9eo8
MD5:	9C10C2707C2DAF76F43201DE8966FCC1
SHA1:	18D5333ED663FE41152C0945896D5891CDFBB007
SHA-256:	CC86BA13AE2F3B8876D7A905F68E6C53664F9F097C4E71BA42833F9E223AE21F
SHA-512:	62639390CAA6936E64BCDEC1ABBA0FE95FA0ABDAC237895186C391A9BC1C97009D7061BF21E2246F6DF8D4E6370A93767EDB879394C7DCF42BDC8F3E7958C31A
Malicious:	false
Reputation:	low
IE Cache URL:	https://theragcompany.de/wp-content/uploads/2020/05/iK-MULTI-PRO-2-MAIN-600x600.jpg
Preview:	......JFIF.............C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$......X.X.."................................................................................4........ J..J......................D....q...U....Mg......]..,....(.....R.:..de...................k..S[w.w..Th.2.UV..M....Uf.#U.e.a.6..(....l.D.{-..q{.:6.e..................>..)...x.........:..../]...[..LKftkn....sO;...U.q...s7:.d...lE..................U..I.k.#.21.s.........6On.R..I..+8SP.M......Z...`k.....A.j:..QY.........H..H...\..3..B.........=..e../;.yn.......M_.x....6........nT.HDL.&.Ly~.Q.8oA....q.3}1..P....#.<.U.=.x,{..Y....2x'I..mz...........Y...2.._+.y.....:e....=..9.?\..X..$..5..G......p...8..\L.A@...0....=C..H.._Z...+..2.E....h.........hz.,..b.^gG.y.uZ.9../%..e...2)..F..Er .n......t....;pD.1@....../7.o...S..@.....yp.t.&...<.z.y.'....G..\|...R.......Q...bs...{?.&_o..n..;...A1..i...... .U#h(..C.c

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\ik-multi-12-2-600x600[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 600x600, frames 3
Category:	downloaded
Size (bytes):	28008
Entropy (8bit):	7.942506840605222
Encrypted:	false
SSDEEP:	384:QguhIEYrrb6gbCSPv1pqYvL4I6qc7PP+urZE+4aEEDw+H68Ar5XVIL2DbXrYd:nE4blYIcI6j7H+udEtZE8MA1k2Dbcd
MD5:	BF1D4CD1BB7E9993636B3D440C6F933C
SHA1:	FD528108CAC4AA713FCED506AA26DC3DBD43D32C
SHA-256:	0B1444A8837B5C084B020A094A70A8C8C7DE7AB96EEFD37B535BAC6676FF4D93
SHA-512:	791EAD8A5EBA042DAC7752C6577DA889B7CE141A10575213E69D35B1A8D48A2F47803B5480027E12A598E08BBEBD90113069BC29E20D732CCF74BDDF2C01E2AD
Malicious:	false
Reputation:	low
IE Cache URL:	https://theragcompany.de/wp-content/uploads/2020/06/ik-multi-12-2-600x600.jpg
Preview:	......JFIF.............C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$......X.X..".............................................................................................................................................................................&V..".h3.I.]Fv^P..X..J7.Cq................#q.6..i...xt.xt.xt......xt.....t.xt.r:G4:F...Dl2.Y....b.....GX.VT.f....).;XaV\|....k.]6-4m..U=./.......\..S..$X....]....:.....#^...T...r...(.QJ.D-...c...m..f.M...9.o.S.4F..k..U.>.Fr..rc.S...fs.z........9Q..lw.y......}z...W7.sO-..\.J...4.dg...'.. ..FI..%.i!..E...6U...T......9K....h..S=..r....O5...E4j.0....s....f..=nfOw2G{..wi.>s.t........^..s...@.h.@,n!7...0....F....d....}..I.kZu.+GOR...i..d.~..4O(.@D....ru.{.-....l.2.,[1/+...a.2":....y~...G.uo..c..}7.....H..Y(.'.#.3.... DdH....8wUy.._m_..Vj..1"H....,.E....C...g....m..rt..@.].y.ubk...r...`..]..GN.c*..F\...N%.R.D$.$.L..(..Q"....MR.Y9

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\ik-multi-12-600x600[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 600x600, frames 3
Category:	downloaded
Size (bytes):	15376
Entropy (8bit):	7.73680844060645
Encrypted:	false
SSDEEP:	384:DzI8e/bqgd4J8t3/mxUq+kpSapHabG/Kpw:DYD3ua/mSgSA/Kpw
MD5:	8FB85F93F94F9F58E4312ACE7EE0FDE8
SHA1:	9862088D9EB203C3A2BFF7C130D1BB111C2F2AFB
SHA-256:	57A3B61502A84D4DC854BD5A9E168A92D00530F33987807019AED905E417FE37
SHA-512:	3E775633274D114623E53F5BBDF7D9E35DD037686B8E4AEB5F14AAB3E19D00B7281493B81F7C829C1D8A8AB7EC4EAE4324007C4F8F5E94C779B10D3158437523
Malicious:	false
Reputation:	low
IE Cache URL:	https://theragcompany.de/wp-content/uploads/2020/06/ik-multi-12-600x600.jpg
Preview:	......JFIF.............C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$......X.X.."................................................................................................................................................K.&d................................m....},...................H. J..@......k?....s>.......................H.. .."`.....br.I.~.......y....9.H..zsxl.................&.D..........[......r.7o...r.[.3..l..j................HD..PJ..HL......A\|.v....96.....y?X1..U1.................D. .B.P$ .....)...o...Vo..X.u.i......K..G.P..h]D..............&.`$.B@.Q .....~....b..#.xoI...o..O.Z..........<S...zl.L.S..zg...............................N\|.}'....=of.'...m.}..'b....:....W...w]Cs............L.H... ......\|....;.kR.N}...-:GD...asC....}.....&R.O4/F...u`..............H..I.....8.i...r..j<..q#...N..i.wX..MI).....:G;.w...}.8l.....................H....wl9.{....G....8..-

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\kxk-500x500[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	gd-jpeg v1.0 (using IJG JPEG v62), quality = 82", baseline, precision 8, 500x500, frames 3
Category:	downloaded
Size (bytes):	22459
Entropy (8bit):	7.663388957763508
Encrypted:	false
SSDEEP:	384:OxdGI9qJFLVSXCjJhEuCV8c3c5mIjEX3pB+oqXbo2him8a+B2uw:OBqJNQXM/EuJXmIouXbIs+4L
MD5:	BCBC3FDF92C711760FA54D41DB04BACC
SHA1:	1F2394B29AC17B1A2767925912F2F8B20D473EA5
SHA-256:	880B0849BA41ED0FB23CDB68DB743E92F836ED73BD776849411C30579C599B4B
SHA-512:	12FF85D0CD485EC946FAB86D98AB37B66CC9CE79D75F7CEC6B7DE509DA61BD27FA10BF167E79ADD0608FD267E5FA6F4B292D4EE1DE040A206A1E907EF18DB306
Malicious:	false
Reputation:	low
IE Cache URL:	https://theragcompany.de/wp-content/uploads/2020/05/kxk-500x500.jpg
Preview:	......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82....C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..R.(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\l9Z4R4oM2tU44QRmk9iDyTxeZNIPreXiQsUQR_P65Us[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	20940
Entropy (8bit):	5.589810981531543
Encrypted:	false
SSDEEP:	384:gGHbn4M16HqVjP34JCVoBR/9eOWDkbQ/2NR/yMFjupWHowiSLTXmkm:/P1sy34J9Fiki2OfUA
MD5:	5C298CF4AAB1B28F96A027AEDFA2225E
SHA1:	7D6D617275514FE925A39054B69DC7BBB04D32EB
SHA-256:	97D678478A0CDAD538E1046693D883C93C5E64D20FADE5E242C51047F3FAE54B
SHA-512:	4493A7D57634A1C22DAE1DBCEC078871A01D343C9338DC5800CD6825E83DB10D340C777E23063ECB09272DC90635C0B60D11EA55C485814E2FFC4BD7CBA8ED80
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.google.com/js/bg/l9Z4R4oM2tU44QRmk9iDyTxeZNIPreXiQsUQR_P65Us.js
Preview:	(function(){var w=this\|\|self,B=function(m,g){if(m=(g=null,w).trustedTypes,!m\|\|!m.createPolicy)return g;try{g=m.createPolicy("bg",{createHTML:R,createScript:R,createScriptURL:R})}catch(L){w.console&&w.console.error(L.message)}return g},R=function(m){return m};(0,eval)(function(m,g){return(g=B())&&1===m.eval(g.createScript("1"))?function(L){return g.createScript(L)}:function(L){return""+L}}(w)(Array(7824*Math.random()\|0).join("\n")+'(function(){var d=function(m,g){return(g=typeof m,"object")==g&&null!=m\|\|"function"==g},E={},H,m0=function(m,g){function L(){}(L.prototype=g.prototype,m.X=g.prototype,m.prototype=new L,m).prototype.constructor=m,m.zf=function(R,W,w){for(var B=Array(arguments.length-2),U=2;U<arguments.length;U++)B[U-2]=arguments[U];return g.prototype[W].apply(R,B)}},k=this\|\|self,gU=function(){},L3=function(m){return m},Q={},wU=function(m,g){if((m=null,g=k.trustedTypes,!g)\|\|!g.createPolicy)return m;try{m=g.createPolicy("bg",{createHTML:L3,createScript:L3,createScriptURL:L3})}ca

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\ltJ0_a7cwOT[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	298
Entropy (8bit):	5.889894537009854
Encrypted:	false
SSDEEP:	6:6v/lhPO67CUyKO/cqK2WgVa2TgOEIzgN+MDBrEMADDWp:6v/7P+U6WgwKLpzS+QBrEMsY
MD5:	BC5A9BB64CC09082F84E51367492ADAD
SHA1:	D95159D1490DB7E2A7F91BF0DDE5070042A95A9F
SHA-256:	185B30B049CB8033321BAC2663646FE5BD84B11A73423D2501E510643E6D5DC3
SHA-512:	2BF200EF9FB5A4C988BEF3308285A7A1BBD55C323C6332F953FF53965BB9D44592ACCBC1C8480C454DF377F9A75BD64A94012E1C2024008057560148D27A6E2B
Malicious:	false
Reputation:	low
IE Cache URL:	https://static.xx.fbcdn.net/rsrc.php/v3/y3/r/ltJ0_a7cwOT.png
Preview:	.PNG........IHDR...............7.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME..... ..:.$...2IDAT(.c`..0#...N0(2...\...C'~......S.N...........9.'..k)...%tEXtdate:create.2019-02-27T07:32:16-08:00.=~...%tEXtdate:modify.2019-02-27T07:32:16-08:00.......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\oEVThCLaFzH[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	476
Entropy (8bit):	6.820192253140971
Encrypted:	false
SSDEEP:	12:6v/7P+UZBY3UsehSBFj2m9V3zS+N3xEMR0:+ZBY3nPtb3zjtxEMi
MD5:	7BFEA40F743B43B79A3659C7237D28DC
SHA1:	8778424A51D9560986C38481044FCA2F36705DEC
SHA-256:	7CEFEBC9017C38E8C2F288129406CB407DBF25A243C2371AE2F79BF7CE50FA0E
SHA-512:	3BB64FC0317469ECC6033DF3B0013E2F3235E68BD0BBE37F8368701C15133715CF6F29E3153641D399666113C4505C0E0D4A450786EAC1143147B2D9688FE84A
Malicious:	false
Reputation:	low
IE Cache URL:	https://static.xx.fbcdn.net/rsrc.php/v3/ys/r/oEVThCLaFzH.png
Preview:	.PNG........IHDR...............7.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.....+.........IDAT(..?KBa....{:6...A.f..UZ...OQp.w.H8.phLZ..cH..p.'...!.H...y..."SXZ..hgm....T...f.......\{uG&...Su.....!.v.&....X.[X..<.X..H.)...'..jkzF..r..h(.o. ......j.($. A.c..1.bj#.=m...[=..&V.`.i..c.i..VA!.9R`"..._S.C...S.'..Z.]t.....%tEXtdate:create.2019-02-27T08:43:17-08:00.n.B...%tEXtdate:modify.2019-02-27T08:43:17-08:00.3%.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\ondemand.Dropdown.c3a8c6a5[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	7265
Entropy (8bit):	5.251748072984218
Encrypted:	false
SSDEEP:	96:ZAFndOtfI4B/D3aSK7G5U8XifMH8Vuww5gJJJ2gCY3vw/J7kBon98tn6TjRllng:ZAFndOiyb3aSKy5U8X2K2uBlgGxZvR8
MD5:	32E511FB1751B1A8FA97475B6C63EF5A
SHA1:	FA4B27235BB93FD2ABE70BA11DEC5953392A3C0E
SHA-256:	36FD0DBDF0B541B3707023D8B2D30D0B02B351DD060D5348972D6EF36F2E6D51
SHA-512:	4C1B7427DCDED216D016D8353800CE7513D381A36376589B95FF15568BC3439235CE04FCBE945FEFC6B7E4D487A82F801B8D294110DD86AB5DA85754C9C5C1F2
Malicious:	false
Reputation:	low
IE Cache URL:	https://abs.twimg.com/responsive-web/client-web-legacy/ondemand.Dropdown.c3a8c6a5.js
Preview:	(window.webpackJsonp=window.webpackJsonp\|\|[]).push([[171],{BqYg:function(e,t){function n(e,t,n){var o,r,i,a,c;function l(){var u=Date.now()-a;u<t&&u>=0?o=setTimeout(l,t-u):(o=null,n\|\|(c=e.apply(i,r),i=r=null))}null==t&&(t=100);var u=function(){i=this,r=arguments,a=Date.now();var u=n&&!o;return o\|\|(o=setTimeout(l,t)),u&&(c=e.apply(i,r),i=r=null),c};return u.clear=function(){o&&(clearTimeout(o),o=null)},u.flush=function(){o&&(c=e.apply(i,r),i=r=null,clearTimeout(o),o=null)},u}n.debounce=n,e.exports=n},VY6S:function(e,t,n){"use strict";var o=n("BqYg"),r=n.n(o);t.a=function(e,t,n){return r()(e,t,n)}},XygZ:function(e,t,n){"use strict";var o=n("ax0f"),r=n("gIHd");o({target:"String",proto:!0,forced:n("sHxg")("anchor")},{anchor:function(e){return r(this,"a","name",e)}})},fyKl:function(e,t,n){"use strict";n.r(t),n.d(t,"default",(function(){return K}));n("1t7P"),n("LW0h"),n("jwue"),n("yH/f"),n("daRM"),n("FtHn"),n("+KXO"),n("7x/C"),n("OZaJ"),n("DZ+c"),n("XygZ"),n("uFXj"),n("+oxZ");var o=n("97Jx")

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\rs6.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	337548
Entropy (8bit):	5.3816172256043195
Encrypted:	false
SSDEEP:	6144:yTT6EQxgaH4NoCXH2pD5p1v9cWH6nBpkGRdbdaRDrnTKbl7wnoyJDdBWSIle:yqTH4Nojv98BpkGRdbdaRDrnTKbl7wnR
MD5:	C0783A3A9C443828A8B26EA96BB2C986
SHA1:	3FE1BBCFD0BC7ADB1C504A057E9243CDB523C554
SHA-256:	387396B35DAA1EDEAB09E949101C7473B855E0C465DCEE906F860DB9CF2BA1FA
SHA-512:	0B312252BD14149D7412078829383E85E5E3A5415BF99995B6175F8C11D21354AA219299F2ADF57DEB76A81840485C6A01648A710F944F4013C5372153C4BF30
Malicious:	false
Reputation:	low
IE Cache URL:	https://theragcompany.de/wp-content/plugins/revslider/public/assets/js/rs6.min.js?ver=6.3.9
Preview:	/*!.. - Slider Revolution 6.3.8 JavaScript Plugin -............................xXXXXX................................... xXXXXX..xXXXXX..xXXXXX............................xXXXXX..xXXXXX..xXXXXX....................xXXXXX..xXXXXX..xXXXXX..xXXXXX....................xXXXXX..xXXXXX..xXXXXX..xXXXXX....................xXXXXX..xXXXXX..xXXXXX..xXXXXX....................xXXXXX..xXXXXX..xXXXXX..xXXXXX....................xXXXXX..xXXXXX..xXXXXX..xXXXXX...................,xXXXXX..xXXXXX..xXXXXX..xXXXXX...................,xXXXXX..xXXXXX..xXXXXX..xXXXXX...................,xXXXXX..xXXXXX..xXXXXX..xXXXXX....................xXXXXX..xXXXXX..xXXXXX..xXXXXX...............................xxxxxxxxxxxxxxxxxxx...............................xxxxxxxxxxxxxxxxxxx...............................xxxxxxxxxxxxxxxxxxx...............VERSION: 6.3.8.... DATE: 2021-02-01. @author: Krisztian Horvath, ThemePunch OHG....UPDATES AND DOCS AT: .https://www.themepunch.com/support-center.....GET LICENSE AT: .https://www.themep

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\share[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines
Category:	dropped
Size (bytes):	46121
Entropy (8bit):	5.353969286684484
Encrypted:	false
SSDEEP:	768:gMItOeVwZqsZOIyKblbb8CVsaZ2FymET+vBfO6y9XNY7HD1N6l3JrXz/u:gMItOJNd2UmET+vBW9Wj1NwBz/u
MD5:	1DB55DF849B84A58523B59CBF3820205
SHA1:	1211F0896181EFE4CCF4FA45DFFEA1DA6BAD23A2
SHA-256:	B32AA4B5208D6E11F07E52B2A93E2C9DC625914E9D1E7596E0E23C2885F62AA5
SHA-512:	8949B30656D9B3610929A0429C1E11155B84E46B7B3FDA2E52C7AB243984A0D7C7A4005713D417E2BE350E4DD325AB84F141C7B6A9977FD65F30BFE27F77A3E9
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>.<html dir="ltr" lang="en">.<meta charset="utf-8" />.<meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1,user-scalable=0,viewport-fit=cover" /><link rel="preconnect" href="//abs.twimg.com" /><link rel="dns-prefetch" href="//abs.twimg.com" /><link rel="preconnect" href="//api.twitter.com" /><link rel="dns-prefetch" href="//api.twitter.com" /><link rel="preconnect" href="//pbs.twimg.com" /><link rel="dns-prefetch" href="//pbs.twimg.com" /><link rel="preconnect" href="//t.co" /><link rel="dns-prefetch" href="//t.co" /><link rel="preconnect" href="//video.twimg.com" /><link rel="dns-prefetch" href="//video.twimg.com" /><link rel="preload" as="script" crossorigin="anonymous" href="https://abs.twimg.com/responsive-web/client-web-legacy/polyfills.e0f21315.js" nonce="NjJjMzU3ZTgtMzNmOS00Nzk2LTkxNjktMjAwZTA0NTlkNmU4" /><link rel="preload" as="script" crossorigin="anonymous" href="https://abs.twimg.com/responsive-web/client-web-legacy/vendors~main.b8f

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\static_map[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 592 x 196, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	21741
Entropy (8bit):	7.976150123897041
Encrypted:	false
SSDEEP:	384:iiuAfbLe4ivIo0ZvFL5o/+WLblmnI+yYt3rSFjdaHF0g:i9AHgvwZdHnI+yYNS6l0g
MD5:	B9825821FE92DCE40272D40127D0915B
SHA1:	0D6105AA918E11A807996E43AD3A91F6246C1376
SHA-256:	BC8D42882BAEFDD9523F7877440A119F6F5D24BEA24692457E1DC4C17A7F529F
SHA-512:	275A815A5DBC564DF8E48FFDDB40F185FFDE89231F6E95619DC68261121AF3FDB917775D8B54B36FE71DAD9333FC2D64EF1908D46D28C7FECE52D37AA1D7DE25
Malicious:	false
Reputation:	low
IE Cache URL:	https://external-frt3-2.xx.fbcdn.net/static_map.php?v=2011&osm_provider=2&size=296x98&center=52.83957%2C8.01549&zoom=15&marker_list%5B0%5D=52.83957000%2C8.01549000&language=en&scale=2
Preview:	.PNG........IHDR...P.........gT......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....PLTE..........................................................................................................................................................................................................................................................................................................................~.......~.................................................................}..................................................................y..j}.]q.......Si.dx..........Zn.......n.ru\|Z]d......uy}bekmszeim......jmslqv...{~.Z^jUZcW^i]bjSVb...TY^ejr\afMS[RU\...tuycdi...XbhJNUDHN}.....LQV_eqcgruz.VWZ...joz~..GKT...=AI...OWa...gpy...OY]......`_e.....T...Q.IDATx.....7.;.r.5..IX..h.8.....n@.8.eKQ.$$..h!i..K..<..}XC....m.&.xZL.4.MK..-.n.."1....MS..B.t........33..}$.....>..z.9s.;............P.."$d?,....y3.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\style.min[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	751156
Entropy (8bit):	4.980932505423387
Encrypted:	false
SSDEEP:	6144:qFXDTEaj+Ycxp+gwEbBefIB5bYPLHnClURNPhWJCvqIeoql24:qFq7BAnClU30Iet
MD5:	BC821676838810EC2AB9689A9F377C51
SHA1:	BEAE0D4FFAC45DB48E50793627D368D248FF3797
SHA-256:	C4535F19FDD4FAED155FC26D12CF6868AA7084214EC0422176D07505EB7F563E
SHA-512:	B0120FD871DA36A28DE594C376E0F0B10CE73A337915C3C2F3283773AB62D949AFF93ADE4CF5B380EBD8CE098925465AC22659D11E93CA84685C23BC569B3DA4
Malicious:	false
Reputation:	low
IE Cache URL:	https://theragcompany.de/wp-content/themes/woodmart/style.min.css?ver=5.3.6
Preview:	a,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,em,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,object,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{margin:0;padding:0;border:0;vertical-align:baseline;font:inherit;font-size:100%}*,:after,:before{box-sizing:border-box}html{line-height:1}ol,ul{list-style:none}caption,td,th{vertical-align:middle;text-align:left;font-weight:400}blockquote,q{quotes:none}blockquote:after,blockquote:before,q:after,q:before{content:"";content:none}a img{border:none}article,aside,details,figcaption,figure,footer,header,hgroup,main,menu,nav,section,summary{display:block}a,button,input{touch-action:manipulation}button,input,optgroup,select,textarea{margin:0;color:inherit;font:inherit}button{overflow:visibl

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\the-gauntlet-drying-towel-corner-600x600[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 600x600, frames 3
Category:	downloaded
Size (bytes):	74305
Entropy (8bit):	7.974369669898679
Encrypted:	false
SSDEEP:	1536:v/dLOvgU4Pzc3a0kmhkziT5PNxGcA8wS5zQzWwNjpJiIML3D:v/0vAzcym0iTBaS5NwviIKD
MD5:	E8F59E3B4A38D8AACF88E7C6FFA4719B
SHA1:	6EDCF6F4A6451FB8C14D18942EA2B3791A2EBD41
SHA-256:	D64D6DA9957D62E805B3F46C09753FC76110EE657DC76EFDCC13ABB9CE5C4FD6
SHA-512:	E75F4EEA8DEE15821909C34F7066C16FC55AACB330A49BEA6D092D0ECB2727DD6DB70881D7DACA481518AEB0632CB86B4E927B86FC0074F49445441C9DAB2C2E
Malicious:	false
Reputation:	low
IE Cache URL:	https://theragcompany.de/wp-content/uploads/2020/02/the-gauntlet-drying-towel-corner-600x600.jpg
Preview:	......JFIF.............C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$......X.X.."............................................................................P.................................................................................................................................................................................................................................................................................................................................~...'.O.>...i..M...1r=.......................E.\|7....o....\L.[R.........RT..Y..K..>V....},.-..VW@8u...............?.....O.w.r.}.r.......C6.T..k.[.?B_.g...3ZzUr).1..k..A.v.U.oW..5..;_G?..{../=.K................KF#..E.uy...Yu0....=...}..Gk.>....).J[.)n..7.KcM.{tM.Q2Y.p.-.e.,.=....rR.u.v......f(.....B...J..Z.@...........Z%.I...u.Y..O:.09....wg<......4..Y.q9....it.....6..63....W./.i.......fx...IuY.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\the-gauntlet-drying-towel-main-600x600[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 600x600, frames 3
Category:	downloaded
Size (bytes):	29104
Entropy (8bit):	7.863591322694307
Encrypted:	false
SSDEEP:	384:EHUnWfzH1weJxLFlLc32ffQMztMVkaksPA3r5lQXthBfqcghJrG47baojc3D:dW1VJZjrf4gEk3s8H4z/W1P75jYD
MD5:	6DBEED721D5D95153669FA0A039168BE
SHA1:	95CE5A0B3F98899FE659C97C805B85AEA37DAE45
SHA-256:	D76390751C4D6A454C3379D6ED071FDFF6AAC64CF9C8E902A26DB36742ECB0B1
SHA-512:	556B3F60251C9663585663E697ED7A0813A0275BE3A6D748BFDF0D14E1735D629F4C2B8673D8A4CF2D5B10C8AA3451D34D5DD0AC2BD4BBBF6D41774BBBEF5135
Malicious:	false
Reputation:	low
IE Cache URL:	https://theragcompany.de/wp-content/uploads/2020/02/the-gauntlet-drying-towel-main-600x600.jpg
Preview:	......JFIF.............C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$......X.X.."......................................................................................................................................................................................................................................................................................................................................................................................OoW.E^..5OQ....T..z..g....Ob....,..>.`....................../...m..,.K.-FIZ..j.2...V..K...E.R.y.......G.k..2................0eBb.s.q=?...5...Lt.v+.w...V.......&....%.~^..~Y.#.b...k.iy.................2./.{X.v.K..8>.\|..^M\|.......7.KJ]I...r...v.Rk6.~...S...l..b..Y...+.w............."%y.1.......:..4.V..F..T.5{..DM.z..~.s......S..A..97.jo...f...y.$..]^u.\|...i,....W..\|.y~.............k...^...49.pG.OI..G..s.........u/..,.V....X.X

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\theragcompanyde[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	5.422436339317692
Encrypted:	false
SSDEEP:	24:kWBlm8XIUTbv+FolB2OJFnlcpJVosf/mCWMV1tyMxay:fNl/v+gB2IFQb/rpx3
MD5:	0DEBE4CDB116C13A9A579BE0EF45D1E3
SHA1:	09359B96A9C23F4C9159F6A30F691C25CFD9647B
SHA-256:	066A445232399F5C3B792E5515A2D676905EF3419BF8A636454BEAE2BCF628CF
SHA-512:	A3750A631522C2CD650A8BF137F1A87EF21ADF3A55F827D4D14BC2BC1307F88FCF9035502BB0073579E161FBD22905FBE664E0CF22CC5BC137B5F9952A9D21BD
Malicious:	false
Reputation:	low
Preview:	<html><head><title>Redirecting...</title><script type="text/javascript" nonce="SIU92NVs">/<![CDATA[/(function(){function si_cj(m){setTimeout(function(){new Image().src="https:\/\/error.facebook.com\/common\/scribe_endpoint.php?c=si_clickjacking&t=8480"+"&m="+m;},5000);}if(top!=self){try{if(parent!=top){throw 1;}var si_cj_d=["apps.facebook.com","apps.beta.facebook.com"];var href=top.location.href.toLowerCase();for(var i=0;i<si_cj_d.length;i++){if (href.indexOf(si_cj_d[i])>=0){throw 1;}}si_cj("3 ");}catch(e){si_cj("1 \t");window.document.write("\u003Cstyle nonce=\"SIU92NVs\">body * {display:none !important;}\u003C\/style>\u003Ca href=\"#\" onclick=\"top.location.href=window.location.href\" style=\"display:block !important;padding:10px\">Go to Facebook.com\u003C\/a>");/WNocmuhd/}}}())/* */</script><script nonce="SIU92NVs">window.location.replace("https:\/\/m.facebook.com\/theragcompanyde\/");</script><meta http-equiv="refresh" content="0;url=https://m.facebook.com/theragcompanyde/"

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\theragcompanyde[2].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines
Category:	dropped
Size (bytes):	160118
Entropy (8bit):	5.77886456759658
Encrypted:	false
SSDEEP:	1536:dJYE7kP/uSneUFkyVL6QiDDoWquXTEaM3DH3zHr/ie/mXiH05L7lQrN1ZvaMadaN:yeMkZrqKM5rqrxmxDwChn4W1vGMRp7N
MD5:	5C02B29E6384AF6980D80494144045F8
SHA1:	E8B1FA06DCAB0608D55C75E669D206389456B138
SHA-256:	DC6A8C0A8A00665448C5DED44A8ACDE6144EDD8B1E8B4A691A8D05DEFDF0BBA4
SHA-512:	90022E53620C70716CEE6CCEE7423BEE1209E86B46F1C3B8DD9E7EE51C9788BE752EC88BB8CDF1373F84424F668FB8AC8275753052B1D432F8E2DB50D6971ECA
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html><html><head><title>The Rag Company Deutschland - Home \| Facebook</title><meta name="viewport" content="user-scalable=no,initial-scale=1,maximum-scale=1" /><link href="https://static.xx.fbcdn.net/rsrc.php/v3/ya/r/O2aKM2iSbOw.png" rel="shortcut icon" sizes="196x196" /><meta name="referrer" content="default" id="meta_referrer" /><link type="text/css" rel="stylesheet" href="https://static.xx.fbcdn.net/rsrc.php/v3/yt/l/0,cross/tupxCHchyY0.css?_nc_x=Ij3Wp8lg5Kz" data-bootloader-hash="eG3x5" /><link type="text/css" rel="stylesheet" href="https://static.xx.fbcdn.net/rsrc.php/v3/yg/l/0,cross/O5aHiOxlYGC.css?_nc_x=Ij3Wp8lg5Kz" data-bootloader-hash="Fbm5p" /><link type="text/css" rel="stylesheet" href="https://static.xx.fbcdn.net/rsrc.php/v3/yY/l/0,cross/VGLH3wFQwXv.css?_nc_x=Ij3Wp8lg5Kz" data-bootloader-hash="S4tG2" /><link type="text/css" rel="stylesheet" href="https://static.xx.fbcdn.net/rsrc.php/v3/yi/l/0,cross/c3MVRnq44b4.css?_nc_x=Ij3Wp8lg5Kz" data-bootloader-hash="HdeRw" /><

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\trc-ulrtra-clay-bar--600x600[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 600x600, frames 3
Category:	downloaded
Size (bytes):	13791
Entropy (8bit):	7.640435172303192
Encrypted:	false
SSDEEP:	192:MvQHqM7kRGi7bB6g4venvkpcU97CEWL7fHW6csX5/JtC3IUwohdrS31dq:InKkEh/Wncr5VWLK6nJJtSVGq
MD5:	4D495B89592E440CC7377FFE205F9E35
SHA1:	554293804FE110825F0E2F36D53315B1C1195F06
SHA-256:	05752BBC0336EE3F9C2E560C169664D1453B3D9EB1929E4BE1B9F49EB919C134
SHA-512:	FCFFDBED7FCE6B2A89F4F118C934711AEE4FE1800C0334ED035100A359E83B06BA23AAB06F6DD85870015A52E3A4FC18CA329869158D6A1A838DBDA8504B7C2E
Malicious:	false
Reputation:	low
IE Cache URL:	https://theragcompany.de/wp-content/uploads/2020/12/trc-ulrtra-clay-bar--600x600.jpg
Preview:	......JFIF.............C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$......X.X..".............................................................................................................................................................................................................................................................................................................................................................................................................................................+$.J..J..$$D..Au...................*.q1(..%.f..>..`.......".eR.A(...&.$.................LS.d..&&...D."`....>q.9\.1.{o.}2.mVj.VQ1.J.r..Y.+p................D..J.KMl.(......}.gW.....{.[?A...'..f..&"&-...L7.n...................0E.$.m.E&V..x..>.....y.....]<Za.KS.\|.....o).t.f......D.....Ec....../...................S.lr.,./..j<....sS?..z.v..q.O...c.g.....tmL3....._<[..tk.......W...'pE..........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\ultra-clay-bar-cl-600x600[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 600x600, frames 3
Category:	downloaded
Size (bytes):	49938
Entropy (8bit):	7.9841994538140115
Encrypted:	false
SSDEEP:	1536:NUJ0f1LgpNAz6zBj/7SURan39oSDQxaNPlIUkH8Ny:df1LgpNAz6zNGiaNZDQxaBlIUY
MD5:	14C8A9991E239D4B4A503D881642830D
SHA1:	446D71DA5615DF1756133C7F5EE310872D611CC3
SHA-256:	B8BDD63194FFB12D59D71447AEA40275C3CA4DEFB0EE380DA7577EECEFF10B0A
SHA-512:	EE35BDF97F579F5F2304BFB2B88EA0F54E59CC193194578E26BC7F1282E62AEAB315D07450FB12C840BC39D57AAA504375CD21168400B56AB38F044299205716
Malicious:	false
Reputation:	low
IE Cache URL:	https://theragcompany.de/wp-content/uploads/2020/12/ultra-clay-bar-cl-600x600.jpg
Preview:	......JFIF.............C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$......X.X.."................................................................................ ...E......../...x.6..U.VN..t.v4r....7J.]b9...z1x.H............"..#M..G#bhJ..cA..c.(.J4.".Q.Q.. ..L...........\.&.ng..3..q..{Y.Mw3R...y.kK.j.-T...2Q.f..9@........AP..$.6.....&.F..r5...".....(.. .V....... .............Q.{./.4.>K..I..N....zK8W4...^}4......%.f[.`.XV5.z...2.G4q....Y#X.8j....@Q.(........0.....%e.6.....].zz................G.s.[.swCb....t%GO..8....?F.....u..\5..l...6.dmnF1...F=...h.......Q.P...............R..;.Z@.jo..pV5..^.....u..@..._...1..=.G_....{4q:Z.vrT:.X.L=.w....Y.z.7...._.t.c.......26o..cX.b1...0....U...Uj..PPP.A.r....Q ....E....Y...`..[uud.....k.........1p.EX.........\.....#{#z.t../.........het.tz86..(.Y$.ls.B.'w+.....9Z....V..P.k.W.....=S.....xt.....l.I..y.]%..._..r.(.-w..`....}3...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\v3JCmIJ_Erl[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 4-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	381
Entropy (8bit):	6.139371923723511
Encrypted:	false
SSDEEP:	6:6v/lhPIF+XUyKwKYKX+Sd0cur+NiAJvizWKiL4IjHPIwsljKzgN+AoztvEM8oJwz:6v/7RUkiufr+J2Wf57PIwsYzS+BxEMNQ
MD5:	93EBA06CA5C4EB99E9C276C89A0E577A
SHA1:	3FA992EC8EBC6E175219A6924A9EA3ABA2B377CB
SHA-256:	6D75633967A5881EF3DA6E1FD578338A2C6825BC7AA25EFF62A07431DB64CD27
SHA-512:	477D18EDB9ED1E3DA1A5C33D6A984EB24CA7138ACD93E8D9B71BC8BE3DF3CB176D3638080CB881B01D8A656FB1FB9CAF0EED13040DF9FF78904CF566EFF6476B
Malicious:	false
Reputation:	low
IE Cache URL:	https://static.xx.fbcdn.net/rsrc.php/v3/yg/r/v3JCmIJ_Erl.png
Preview:	.PNG........IHDR................R....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...$PLTE..!..!..!..!..!..!..!..!..!..!..!.....se....tRNS.[..FE.......I....bKGD.........tIME..............@IDAT...!.. .D._,..z...9D.9.(V....3.%.G(.....c....?.G..g.B.7......;c.....%tEXtdate:create.2019-02-26T23:26:08-08:00.......%tEXtdate:modify.2019-02-26T23:26:08-08:00........IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\wS_ljYS7lBF[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 4-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	158
Entropy (8bit):	5.533796490656386
Encrypted:	false
SSDEEP:	3:yionv//thPl9vhSF9fseoWFWFWFWFWWBlliRi6UNH/gSCi8gsakelM9dp:6v/lhPIFihWFWFWFWFWc/Vykyp
MD5:	AA6EA1775D0251C7E0B5B336E86DBCF7
SHA1:	31210D38C3347D6A63EB100CEEE0AFD0E11E8C1A
SHA-256:	3A9638882694684421486D84738FBF81C9598BD39DE52097BCF4BE60CA376D4F
SHA-512:	D2D171CAA0AA5B3468793B4492E40033E2A3B8541B42FEE47EE6362BD4656D0DF2A8C12342B5C967308C75DA2F57852B17DB39BF9B34A935E73566D51375D70C
Malicious:	false
Reputation:	low
IE Cache URL:	https://static.xx.fbcdn.net/rsrc.php/v3/yM/r/wS_ljYS7lBF.png
Preview:	.PNG........IHDR................R....PLTELiq`gp`gp`gp`gp`gp`gp`gp..eS....tRNS......,.`.....IDAT.[c` ...B40.....BE...E!..s........T..@...$..N........IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\woodmart-font[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 20144, version 1.0
Category:	downloaded
Size (bytes):	20144
Entropy (8bit):	6.400135413530874
Encrypted:	false
SSDEEP:	384:6Oh2aPb+PsYSw+t3YbBz/jR0C9EJIcS7fEyXSC2y7aw2MUFgMLSBzZ:Bjb+k9L3YljR0COJIcSLE3C2y7aw2MUc
MD5:	DB8E037E138A7F0B7902EAB0285087C1
SHA1:	68E6A68DCB5DFE755BE0EB8CE1865CFBCFBEB957
SHA-256:	591EB5805F73292E997F36D8BAA027A69F5E4A2AD367F0B15CE656AEF3083062
SHA-512:	85F5B1A9BB092A691B51805E8141AFE75C974F73815E696F8118EBD48882FC0112D14D5CD6B1E35A6621132F9FA9AB406101B03627F8AA532152EEA88A492724
Malicious:	false
Reputation:	low
IE Cache URL:	https://theragcompany.de/wp-content/themes/woodmart/fonts/woodmart-font.woff
Preview:	wOFF......N.......Nd........................OS/2.......`...`...ncmap...h...........gasp................glyf......H0..H0.{..head..JD...6...6.a:.hhea..J\|...$...$....hmtx..J....T...T8../loca..K.........~..maxp..L.... ... .j.Mname..L..........e..post..N.... ... ...............................3...................................@........@...@............... ............................................... .....).9.@.I.Y.`.i.y.......... ..... .0.?.B.P.`.b.p.......................................................................................79..................79..................79.................7.;.?..."............327>.7654'..'&."'..'&547>.7632.............3.#.3.#..j^].((((.]^jj]].)(().]]jUJKo !! oKJUUJKo !! oKJ.ffff..((.^]jj]^.((((.^]jj]^.((.f! oKJUUJKo !! oKJUUJKo !..f..........@.........&............#"&5.46..>.5.&'...#.......267.......J....9^6.......N.......(.-.....V..15.4=8...............................d.....(.I.b.f.v.z..................0"18.1#"&54638.13>.7>.54&'..7>.%35#"&546

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\yzxwaDMdZAx[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	440
Entropy (8bit):	6.67864607982877
Encrypted:	false
SSDEEP:	12:6v/7P+UNoE3n7f66MDwAkios9fizS+TzNEMXzY:+6s7fWD8cfizjlEMk
MD5:	C87A9A69BC43B431EB4EF81B6DB137B6
SHA1:	76DA9CC6165AC7ADC2003C45F03B75DC13ECBC74
SHA-256:	66671BE00620CD10FE4BF1F575AF34B2081B3EB55A150E05FFBD754B603ED5D8
SHA-512:	7D97047999BD10E23AFD831F7F323403266E700231F27E1060459F16B57A57ABCF1793F8A084696A8916F693BDD8A85E9E8C644157634B50B556998E5B60BF41
Malicious:	false
Reputation:	low
IE Cache URL:	https://static.xx.fbcdn.net/rsrc.php/v3/yG/r/yzxwaDMdZAx.png
Preview:	.PNG........IHDR...............7.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME..... ........IDAT(.u.-r.P....6.`.."......(v.H$ ...X....X.&:...)7)9.s..~^:...F.RH...L.\-..,\.lM:.D."..M....+]l... .f..RK.eAj.+...T.cJT4..6.{.6C.m........G>.F.K..l.k.w~.o...(..N...i..2.X,...:.O..........6 u..y...%tEXtdate:create.2019-02-26T15:32:05-08:00{......%tEXtdate:modify.2019-02-26T15:32:05-08:00..Zm....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\1487645_6012475414660_1439393861_n[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 10 x 10, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	79
Entropy (8bit):	4.71696959175789
Encrypted:	false
SSDEEP:	3:yionv//thPlH1tnt/tAhHGZscm1olkqCwbp:6v/lhP6hHDcZCYp
MD5:	8DC258A49B60FAE051E9A7CE11AD05CF
SHA1:	DAFEF280663F4205FC7F0E47799E9945E6A68D6D
SHA-256:	C8CAED93847AFFC154CB3D424E34FC146E7340BB29ABEBD5EBA7063E3DCA0604
SHA-512:	5F11ED60D79A80EF7CCEFFA907CD55F31D8DB19BD2A7F4C2650C62A355C5071C5FB61DA1EB0A2071CE22ECDC35C0D12F51E4D13AAC3B0FDB95ED4629815B5AFB
Malicious:	false
Reputation:	low
IE Cache URL:	https://scontent.xx.fbcdn.net/hads-ak-prn2/1487645_6012475414660_1439393861_n.png
Preview:	.PNG........IHDR..............PX.....IDAT.Wc...0a.!..)....A,....Zl....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\1614093251-7832dd33b8e5ebffaf4df30bd25f27e882c4a40c.min[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	9067
Entropy (8bit):	5.103652843478825
Encrypted:	false
SSDEEP:	192:rtl9rc9xKhbMtRTskRGLF+AjBRC4ogRBqm:rtl9rc9xKhbMzTskcZ+AjTC4ogB
MD5:	B9FE10973389EF31FC8722208CADA3F3
SHA1:	7832DD33B8E5EBFFAF4DF30BD25F27E882C4A40C
SHA-256:	F0DB1F1176F5EE1C0674C6B0F5A1D3C705E7AC59603C146CE13686EDF3530FF3
SHA-512:	2E8100E5B704E2C63700B2971818D7F10CC82A6753BAFF17C98C848B49D3D7EEBAD17E1AE53A6CC64F0E3324DC7266CCB9EB2C043ED4DC29D75FFF7907EF319F
Malicious:	false
Reputation:	low
IE Cache URL:	https://theragcompany.de/wp-content/cache/fvm/min/theragcompany.de/1614093251-7832dd33b8e5ebffaf4df30bd25f27e882c4a40c.min.css
Preview:	@font-face{font-family:'Lato';font-style:italic;font-weight:100;font-display:swap;src:url(https://fonts.gstatic.com/s/lato/v17/S6u-w4BMUTPHjxsIPx-oPCQ.woff) format('woff')}@font-face{font-family:'Lato';font-style:italic;font-weight:300;font-display:swap;src:url(https://fonts.gstatic.com/s/lato/v17/S6u_w4BMUTPHjxsI9w2_Gwfr.woff) format('woff')}@font-face{font-family:'Lato';font-style:italic;font-weight:400;font-display:swap;src:url(https://fonts.gstatic.com/s/lato/v17/S6u8w4BMUTPHjxsAXC-s.woff) format('woff')}@font-face{font-family:'Lato';font-style:italic;font-weight:700;font-display:swap;src:url(https://fonts.gstatic.com/s/lato/v17/S6u_w4BMUTPHjxsI5wq_Gwfr.woff) format('woff')}@font-face{font-family:'Lato';font-style:italic;font-weight:900;font-display:swap;src:url(https://fonts.gstatic.com/s/lato/v17/S6u_w4BMUTPHjxsI3wi_Gwfr.woff) format('woff')}@font-face{font-family:'Lato';font-style:normal;font-weight:100;font-display:swap;src:url(https://fonts.gstatic.com/s/lato/v17/S6u8w4BMUTPHh

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\1614093251-f580518998530f1d8d2ed3462d0117e998311045.header.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	89641
Entropy (8bit):	5.290485734061822
Encrypted:	false
SSDEEP:	1536:ijExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h8cApwEjOPrBeU6QLiTFbc0QlQvakG:iYh8eip3huuf6IidlrvakdtQ47GKW
MD5:	633F16720FF4E27DFF494DA7D8064394
SHA1:	F580518998530F1D8D2ED3462D0117E998311045
SHA-256:	76400E7ECB7FED216A753061A013A9EF192F001262193365E26B20C235A8C4FE
SHA-512:	D3C08651C334F24C579AEBBEE5CAEC641C7204CD61AE14EF6ECCB0D4DAABD951C0A2BC0026FF3BD4B1072D7C4C9087943E510592F3BC57980A2A894DB2FB6085
Malicious:	false
Reputation:	low
IE Cache URL:	https://theragcompany.de/wp-content/cache/fvm/min/theragcompany.de/1614093251-f580518998530f1d8d2ed3462d0117e998311045.header.min.js
Preview:	.try{./! jQuery v3.5.1 \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\26815159_336567870178078_2443636191392408321_n-500x500[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	gd-jpeg v1.0 (using IJG JPEG v62), quality = 82", baseline, precision 8, 500x500, frames 3
Category:	downloaded
Size (bytes):	11759
Entropy (8bit):	7.2417534719834595
Encrypted:	false
SSDEEP:	192:u/cgudYFvbSPC9LUidwb8OkE9pI2kUHjPkFCzZJaRBHdrChm4djjbz:OccYqLzbET1DkFuZI5dd4pbz
MD5:	090CC2161241D96449BB3754B7FD00F8
SHA1:	D8923DECE1DC95B94CE28340203A312457A25F53
SHA-256:	42FF8CA5ECB4272FA01EFD9800D3C77B63EFBBA77B131DEEF425CD8D0ED7E508
SHA-512:	072BD6EC8C9E28FD508077A7475708C2E57BFD9866EA98B51AB6C448938F583E217DFEC07F66FB57618BA6CB2BABD6B97C602802B1DA329ED123D62BC65D2BE6
Malicious:	false
Reputation:	low
IE Cache URL:	https://theragcompany.de/wp-content/uploads/2020/05/26815159_336567870178078_2443636191392408321_n-500x500.jpg
Preview:	......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82....C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....(...(......J)i(.....J(.......J)h......J)h......J)h......J)h......J)h......J)h......J)h......J)h..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QE..QIK@..Q@..Q@.....QE..QE..QE..QE..QE.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\26815159_336567870178078_2443636191392408321_n[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 960x720, frames 3
Category:	downloaded
Size (bytes):	12116
Entropy (8bit):	6.781394786809221
Encrypted:	false
SSDEEP:	192:2kn0GlPvn0dfPnEJ5Y50Ql0ZHDH4sti9XszPL42NZ+mxpl:2ktlPffjY501ZHzn8VszzrNQmB
MD5:	360F55D7A657D010FB6729A44B58AC11
SHA1:	5A388EB1BC66CCB98312E808C144B20270E6D543
SHA-256:	3AF9CA9C52BAA095425D25B34F97667C72B4E1184EE6F244FFCBFC9A916BD6E9
SHA-512:	DC802F6A1B76BE7030282D6FF57A1254A250EAA3DFBF66F0B029A1E1D1FD1FC79EC1B9C03CCD65951F6D8319DB8AC54B79F6C192594474DEE9DB041BB13B1BBC
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.theragcompany.de/wp-content/uploads/2020/05/26815159_336567870178078_2443636191392408321_n.jpg
Preview:	......JFIF.............C...........................".##!. %5-%'2( .?/279<<<$-BFA:F5;<9...C...........9& &99999999999999999999999999999999999999999999999999..........."........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................Q...7,S...../p.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\4X7T43V1[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 512x512, frames 3
Category:	downloaded
Size (bytes):	9886
Entropy (8bit):	7.531511314692504
Encrypted:	false
SSDEEP:	192:MZCVOff6XqyoeLEh0Qj2wnS+5aRjc85I61XH:+i6yoepQj2wnz4W61XH
MD5:	25ACF41A087467C1533309E4F591423A
SHA1:	37218A9867D2ED934F6BA8DF92885753AD7F165E
SHA-256:	19FA410B0EA0862FC9D28A4378E4A1EEAC519CAD335AA3A8AA1421BECF235DF1
SHA-512:	4ED81C6395A475C1EA81921BA1C6F8AFB897FF51F972EC7046100FBB95E48375F71778FC051D7CF7F732A4A89AA1E10DEA0D0B7287A058A52CEBC9A773C9727B
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.theragcompany.de/wp-content/uploads/2020/05/4X7T43V1.jpg
Preview:	......JFIF.............C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$...........".............................................................................................................................................................................................................................................................................................................................................................hF...........%...J..`R..~.F.2.V6..}...............@..&q...).:<....82..(.;.....Xsg1.%....{...E..l...............DR........G...f.G.g]0.O..7.. .mc..o=>g.r..................@..&q...).:<....82..z.X....pv]..R.....=..................+...hcy.Jj.8z?...&..;..=..-.:k.OFhi....l..................+...hcy.Jj.8z?...4..Z......$._D0..I..y.1f..-r................@..&q...).:<....82..(.;.^%u.....V....+*o.....s.{O...................$J.4}.i%..J..R.F...5.IU.asCI...............

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\87398005_108699220728865_1199949094395576320_n[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 40x40, frames 3
Category:	downloaded
Size (bytes):	1170
Entropy (8bit):	6.818369869178059
Encrypted:	false
SSDEEP:	24:gqEnfCYTHo8k1rANSbG/F05lwKfUkTnUJbRTGnYlJZMWYB2tr:gxCYz3t/F05CAUZbRTGnYlJydB4
MD5:	205CA152AADAA2C610B890609A59EF47
SHA1:	EADCD393B731BE539CC1939F06EE3DB0ADF2D88E
SHA-256:	FEE874CAAA5AB38ECA46ACF96AB57B41A9B9E5F70FE04E5A7C0434DD3496E3A9
SHA-512:	F4BA355019781CB50AA114DD6204A29AD29FA47184B8A2826A5A15B210FB10B9AE99F4EC6C6FDEE7CC82C4B5ACBDC7388815B8F721696DFCC2E4A6C1B466BFA4
Malicious:	false
Reputation:	low
IE Cache URL:	https://scontent-frx5-1.xx.fbcdn.net/v/t1.0-1/cp0/e15/q65/c1.0.40.40a/p40x40/87398005_108699220728865_1199949094395576320_n.jpg?_nc_cat=100&ccb=3&_nc_sid=dbb9e7&_nc_ohc=N9uNMrKOVFQAX_pZ_W0&_nc_ht=scontent-frx5-1.xx&tp=5&oh=ac5f8b255d02ea56380a76387effd279&oe=605B4236
Preview:	......JFIF..............Photoshop 3.0.8BIM.......h..g..OBi3anw3CZc-99yHovSE..(.JFBMD0f00076b010000bd0100005902000090020000d8020000d20300006a04000092040000...C......................"....)$+*($''-2@7-0=0''8L9=CEHIH+6OUNFT@GHE...C.......!..!E.'.EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE......(.(.."..........................................................................$.d.......E.p.....Ws.q..6....i.\............................................s...t95uf....l.&.A.....vxS)....o`!.0U..F..\....$A..&..O...e81H.XW.._K....e.........Vmrc...%r.;6T...;...<.AX. b#.......................1............?..x.x..A...F..............................!1Q........?.".J........%.............................!.."1A2..#Ca.$Qbr...........?..."..>+..7..J=c.....0....9{.... .....R5. .izW....R..U..c^..W.A.O.-V.....X..c.lz..j.D.t..$.G.d.3..../..."H.....M..U...].O..n.....E...&...O#p..6...............G&.....J.....5..K..+oQ...j...x...c..............................!1AQ............,.;?..V.<

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\Autolack-Affen-350x350[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 350 x 350, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	94382
Entropy (8bit):	7.993855257608946
Encrypted:	true
SSDEEP:	1536:ckwsVlrN0lhKmxRpksoaTFkLkpQOYi5VkSFwo4xNANJ6cIj4xAr/HxiSYKzye1N0:cklXrN05xFFWkpDYi5nFw/cm4xI/HQS4
MD5:	709E5173E7B6E9E78851F55299236258
SHA1:	B8F0C96D61F4941F2B3AB7E2CDD18318879B0985
SHA-256:	BF4EF69446730CB57AFFB432CFA4BAECB239BC351E51906FEE926024F7EFA547
SHA-512:	53CEB270E95F967E5A125687A7210F0714B7357BF0CC46E8829478569BDFEC3AC41291B28DAD6B96F12ADD5CB60CBD11DAE609473A09435CF0492B88318577B6
Malicious:	false
Reputation:	low
IE Cache URL:	https://theragcompany.de/wp-content/uploads/2020/05/Autolack-Affen-350x350.png
Preview:	.PNG........IHDR...^...^......+w.....pHYs..........+.... .IDATx..]wX...~'!...".....`..b.m]{[..{].....{_{/(V...PP...{K2..!aj.......}.H2s...9s...h...Zh...Zh...Zh...Zh...Zh...Zh...Zh...Zh...Zh...Zh...Zh...Z\|. ....B..\|...../."I.........H. ......w........o.z..Q...BCh....;..=.y...v.-.=.aVff....~...66u.895KOOGFz.rrs....CCC....$H...B&.i..H.::: e2IR...b..U]..............g.x7..5.....7lm.C6m...m.4i.X..YS.7w...qh.........{..Y.C...W.^.._....OP.z.....v.....Ui.rk.,7n.. A.....%I...gni. ..=...R.....6m.#C.7.I..}...CH..z.i.-.P.....O...?.?z....\|pLL.Q..d.......(..V.S.F.wN...T.$I..A. .. Hi....061....223..6j(...N.U_v..=.E.!.".....^-.....U..9j...9..K.;;...QQ...t.I......Z0..@ ...!..b..:::..))).T&.L&CA~....Q.L9.. ....k5.......=....ibf.w........9h....8z.D.?..t.......].....Y...+I..) .B.."8V..+++X.......U.aaa...........:::061.@@OO.".X..I...C".@&."7'.%%%...GVV6..........EzZ:.........@....t3..I..C........0.F......}...i.......?......"".....JOOo../...g4...D"..25......adl.kk+Ts

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\Edgeless-245-All-Purpose-Microfiber-16x16-Terry-Towel-600x600[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 600 x 600, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	82805
Entropy (8bit):	7.990831426349782
Encrypted:	true
SSDEEP:	1536:kKtcYj/Toe/I1vM/MAdMmz5ToioLcqKTKVqs7eCXbFMJm6i:kKZ/TpyGLdv5TJoLcqKvs7bXxf9
MD5:	9C35E37817FF437ECBBA5CC2ED5F7159
SHA1:	43BE2710538385B04F7A374FED1FE18A387EA075
SHA-256:	3680865F841EBF9D694A32EA07407B9784BA8FB2F8030C45ED9CCD9EDA94267E
SHA-512:	F616CB8F8ECF945ABFFB68BF4DD56B6C42C9B740F8B17187A149CDE2DB0658CF48BF528B5C18AE66FFECB080F2FEED5959F6D9D2E6650852523BD4CB64DE85A4
Malicious:	false
Reputation:	low
IE Cache URL:	https://theragcompany.de/wp-content/uploads/2021/02/Edgeless-245-All-Purpose-Microfiber-16x16-Terry-Towel-600x600.png
Preview:	.PNG........IHDR...X...X.......h.....pHYs..........+......PLTE........................................................................"......M..H....uA..'............&.....;..B."....2....s........./..q..U...m<.d4.t7.V...}..~./...[..%..h../........n3...`'....g0.<.... .1......>.C..z....}J.\|;.h,..CY..U.J .8....d[.......7Ax...o..p.J.m.\..)..E=p...A."....M..Pz...zS.N..].....G.D^.Q..y..{(..I.H...b.W.9...2..M..R..=..........W-M.K..U.:..0.=..H.....^.T.9..d...c.....9.$-1i...K:.Ch.Y:.;..KI...'.n......q..R..Z..d.....".....].. ...1.... `....A.C.......C%..SLq..W.u.cn..@g....Z..M.8.{.E..?...-...D...0^...%.m...9....&..@#T.2y.z."/..1l...Hx..+T{.'t...^{4.:.F.....e.b....Q.2yh.......)V?. ......."n...0....gi.=..K.7.#?w...3O..Bh@]..r.n..&\|..3W.Ik....%`...c...&..8...kA.OjXn..:X..P.~2EOIR.... .IDATx...j#....VUR).`....S.JKm./..........<..H+.......D.....z....k[*.Jv.:}.Dd._..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\GWGxn_Tx65X[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	473
Entropy (8bit):	6.830103214076186
Encrypted:	false
SSDEEP:	12:6v/7P+UpGdLTf2Xy9oOBLhGlycG2zS+lgEMp5:+pGEi9JPG7zjlgEMp5
MD5:	0B38F2B240DAC491250D16B1FF7A9F8F
SHA1:	22ED34F42BF03E0843574D79B5BE54C4D9E30D6A
SHA-256:	012CFA889ADCE94DAFDAD015E09A6FB50AFC34AAB4123FA88081E383333BB6F7
SHA-512:	CF2CE19D13217EB1282C72D8EC6A4B437C3DAB8829C3692ED3A760582CB57CEE6A92E2BFD321A8D358BD5BCD4BAD96AC45FCD981F2065F8F104856AF0EB848C7
Malicious:	false
Reputation:	low
IE Cache URL:	https://static.xx.fbcdn.net/rsrc.php/v3/yt/r/GWGxn_Tx65X.png
Preview:	.PNG........IHDR...............7.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.........tIME.......nv.4....IDAT(.m.JBq.....2.........D...........gp4"".. C(..F...K.C..{.l....9?~U.5..6.U.S..HKUU..D=.<.e\|....$R.DId....6.c..X..a..H. ..i........R..}.X..5.@_9%S.3...{..9....v..<.\x.V:.......\|.W{....U"w......8.l.Sd./......v....5!A.bJ...%tEXtdate:create.2019-02-27T03:05:28-08:00..V....%tEXtdate:modify.2019-02-27T03:05:28-08:00.......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\GlossBoss-800x600[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 800 x 600, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	238817
Entropy (8bit):	7.992334033881971
Encrypted:	true
SSDEEP:	6144:G6q0rdUE+w9B4/SXyZTkgJp2wXhKSup6ImlxNNcGkEZTCWWcZHZ:Rq0Cjw9qZQgX3hKrwbDNC7cH
MD5:	7F05995F4E38A6D3C39151990401EC0B
SHA1:	51E7D38A0E8F852A65BF4BD958616D2579B424D8
SHA-256:	7C3E6156D42DBE98DB8420DEC866DA692DBE7F5CE74B70DF0C28EAFF12F0EA86
SHA-512:	1585C9688B3B8C6817383330CD0C21B5B2FF2DD56EF21AEDBE8FC4C2A8B7D969110303106060B2A7CEFA1C185B13262E40660B69BDF2C08A4F6B18E8E064E16D
Malicious:	false
Reputation:	low
IE Cache URL:	https://theragcompany.de/wp-content/uploads/2020/05/GlossBoss-800x600.png
Preview:	.PNG........IHDR... ...X......v.p.. .IDATx..i.%.u....o.W{WU....zA7.....I..$..IA4!."5.I..F.g.93....f...l.y.}4.eI....H.....dR.".$Vba...@...z....1.2#...\|...z...t..X..FdD...M.B.A. .k..(O....`K.{>-..q...e.=#.,.].ce.u.O...j.m.>O.\|^.Q.......c;..M:...........J.;.._..S.T.L(b.Z.I..<7.....n._K.r...X...5yT.9.f.r.=x%C.F`.=..C..)...E.:............\|.W.T...C.!IV3.i...O.....&^{.R.$;0V.0G-..tu.Q...m~...#0...W.t..l.F.]N.N...#0.#0.c}2".py...@.Zr2.y.m>.ii..r..A,.O.Fo.....C....R..].ce.......&E;....\e./.#0..A./..}.H.$.L.. 0.#0.#0.....,.....$.S.(V.)+.b..W2.U...qE.....v=.....2..O`.....2.w;M.....e...i`.F.1\...=w..^..g...........AKy.}.A.7..n..1.d.{z....].0V.(.....H".`.F.2.....r..=0.#0.#0.......~..'*.%).o....d(.......e......C....z.4/..v.....e.r&N.....G...e..J.#0.#0.#0.+#..}.5...+'+..{&V...9.....3(...m..a&i......t.6..t`,...z+..(.<%.S...............>}.G;N...F`.F7.%.......G`.w..n.R.N....]...I.%..N<W.......H..".~..&$...#0.....S>..?Z.#0...kJ.Q.H.@..H.B.-\Q.WMp.P.\|[...G`.Y....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\IK_Trigger_Multi-900x600-1-600x600[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 600x600, frames 3
Category:	downloaded
Size (bytes):	15224
Entropy (8bit):	7.717198757318397
Encrypted:	false
SSDEEP:	192:Mimd7VtYejunTcGQbUALtNDUUbzsUJbfM4ULA+GXwaMd76p1+OLGtrOz9JxFD6VE:mdBtyoGkHlAt40aMh04uvx1zzTck3wi
MD5:	992C6D46085C3B13A69B2AF214552813
SHA1:	C337238A1219A1C2DD9EF8E984CCD11D20BD9015
SHA-256:	7FC0E00BFAE44E9594BB76B01822F5BAF7BE4E5FF46451476A841D282AB60D96
SHA-512:	FC8C8987C5EB69A8BCDD1399F66F776FB7AFAC0233C0CE184A715733F0E89348EF21D9A95836AAD39DB816E87B8FE7705FEAC97313D089660CC7644FF2FE58C5
Malicious:	false
Reputation:	low
IE Cache URL:	https://theragcompany.de/wp-content/uploads/2020/08/IK_Trigger_Multi-900x600-1-600x600.jpg
Preview:	......JFIF.............C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$......X.X.."..................................................................................................................................................[.y........D}#<...cd.......................-.........;........o..y..?....^2.dL...q.}._..q........................w.s.9...g..)../.5=RY....W.....d&6....j.;....n..........................7.........{?e...)._..2......^.g.}.[..9.....2.....................8gs..y...WI.\.....Sg...v.......rm..Mv.\.o..^.N.%....................#....,.t.c..d%SP....N+....un...NM..%............................Yf.... .......>{./W...k..".......................\...+:.X.~.P........u......2} ..P......................k..{^.L...(...N..Y..o.vV.$..S.wY.@......................t.?B._gA(...4].......5;.K}.tX.........................[..Ur.}c...0...k>..=,..........................1.....\.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\IMG_0162-600x600[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 600x600, frames 3
Category:	downloaded
Size (bytes):	54335
Entropy (8bit):	7.978370132724949
Encrypted:	false
SSDEEP:	1536:41mqzlOcEMN0Ti5V0PnbYJ/3Rgwfai4CzTW:q10VSz0PnbYJ/BPatl
MD5:	93146B5669BCE03A873C587D7AF86E94
SHA1:	9F32FB30972F2302865D2B2BE00BED4FA8C5AE76
SHA-256:	7BB89513550958A8784D0D4398B2F1F159D7AD2B27C0149266EA937D68EA4892
SHA-512:	F62DC8D86D8006C3DB438FC1F869DBC80EE0B09A6586D16BC8AF07E2B3DE9AD979462E0E986DF15E7622C4431026B14D3992BB6A1AF3CD5523415B1FDF6A3DF8
Malicious:	false
Reputation:	low
IE Cache URL:	https://theragcompany.de/wp-content/uploads/2020/08/IMG_0162-600x600.jpg
Preview:	......JFIF.............C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$......X.X.."....................................................................................[\.g..vbE."Wf.._^P;.;d....^b..0S4....Cr..Z.eU.c...d.h.j.,={A..d..........s.2..$.c(.$.......L....@.{.2)...5....}......P..j..:.~Z....]:.k.z..k.72.Ff.6.2.p....'/h.K..b[.h..a.5..@.#...j......1..._.S..)..b.g...l..Pr...<.u.g....xk..rtbN9..r54+..z.Zx].ZQ.....r,.Z..e.H.su(....=.t.m...R...[..zc......5.Zd5,.$..mC...........M...3:..........Y.lq.9la.[..ar...F.8...3...Mr...-8.....Y..7.(f...2..I.E..."F.....v.....#..^.......G...[3..S..K0...\1...jv.G>.LU.a..s$gm.nW%`.(......]...B..E....y?.y.M.]....J.z...qP......U....BR...;TW9\F%-..q..Ukb..#"..YR..B...}.F.+...#A}...NH.IvK.W..K.....C.4h..4k.=.%.\.7M. .Nf....X...@..Z.....U....S=O..e..=...oCB..ts.2..m....iteY......G}G....m#.....0.....Lih.$`"..?+g$...s...Am.Q.f.....[.._\|Ic..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\K3WTL9rMJbi[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 124 x 279, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	28076
Entropy (8bit):	7.986480050665834
Encrypted:	false
SSDEEP:	768:2RWYdYRxdmdo9cDDwtEbQWRmUO/1w7Qo9QqHkNE:2g2m2LDDwiFvO9iP9QqEO
MD5:	3430F9CAD9B0D06F796C4CBF06906E89
SHA1:	B6E516D9ACE6E9EE58DC96D6503FCADC890570B4
SHA-256:	C8225821170AED7E5F96233E6E42053E82B4A887422992C871602A5A0053123C
SHA-512:	E4D451A3E640E6FB11D112D48F998530E8B440C11CBCCCA9DDBA8CF2AE31D0498DDA7C83EC2D0168C0D9ADC4F02634B5F2DE6918B44867246764AE149B3D8BFD
Malicious:	false
Reputation:	low
IE Cache URL:	https://static.xx.fbcdn.net/rsrc.php/v3/y1/r/K3WTL9rMJbi.png
Preview:	.PNG........IHDR...\|.........oZ ... .IDATx^.}.........e.....".I<.31.EDEq.,.EP...E./?...c..( ..(.n...5.FCb.A.F.DEX....~...{.....p5....]..U.z.^.z.J.Ob..D4...#..D$....V.!~.W...c.1D....CD....B...;.^......ED..v.-..!.......,.\|.3.g..<.......z..X{.5.^..>....- .....].h..U...7.....NDW..{........q.x...O[.":I..q......(c.....w....5^...v.N{E.7..j..7.......\...i.@..'...!.3c....F..."...j"ZLD...D4...B!D...3.'.K..D"..)...>#...j.B..S.H.6..:....$.......!3.g.:.H.Z..h...x.&f>..&....o.l...%..B....`....8..}\.@.W..}B...,3....G.. \>....]...Y....}.W8.........Nf....Y..f..(.....<'K._0.W.U...1s,..-.\.Gp..........4O;...m..{`od......Rw.p4.Cs... x....#.A..R..Ws....+}..\...\.<.k.Dg..<`.! ............!......bT. .di..pf..........7.....\|.O.. .!.l..W.S.....6'.S...p.....>..'.........X0h90....Q....V.0'..,m.\|.3'<.s.v.....sOfT.....E.x.....s....._.z....cf..:. A...ZO..r..^7.f...b>v....OC..v..o;0H..8.....&.....`.W=....4.{..WP.eA....x..k\|..............I.dvg....E...S3L.....:..x...6...;...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\KFOiCnqEu92Fr1Mu51QrEzAdKQ[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 21704, version 1.1
Category:	downloaded
Size (bytes):	21704
Entropy (8bit):	7.973226712101604
Encrypted:	false
SSDEEP:	384:wRRPUc1eNeMm6IbAOqBx9ybZoVdpnL5Q9Evdah83CTyTwyjP/J71FenyIw9:wnPv1eNeMm6eLEHyAdhL5QE0cwOP11YM
MD5:	F9E8E590B4E0F1FF83469BB2A55B8488
SHA1:	E90B097A67B069E35C13D4D481D259C35BF0A8B7
SHA-256:	5A3A9840414768FA2EC988B33C9E966FDFFE2DB7E560A270B3A9C6BA01F17718
SHA-512:	3E00FEA12DD63B19F97ACC765D1EED6810EFFFEDE185F8F37D56A827BF1FCB5DCACFE2F92F9031125B262B6E96120319481B4208A349D01DC8707AEAB6F7C319
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/roboto/v20/KFOiCnqEu92Fr1Mu51QrEzAdKQ.woff
Preview:	wOFF......T.................................GDEF.......G...d....GPOS................GSUB.......'......r.OS/2.......O...`t..'cmap...$..........W.cvt .......H...H.2..fpgm...d...3...._...gasp................glyf......AD..t..1..hdmx..M....o........head..NX...6...6.\|.hhea..N...."...$.}.Ohmtx..N....n.....M.loca..Q$...........Amaxp..S.... ... .(..name..S(........ G= post..T........ .a.dprep..T.........+6.x...1..P......PB..U.=l.@..B)..w.......Y.e.u.m.C.s...x.h.~R....R...A.J.x.l..h.a........l.m.6.1+.X....i...y....&...._..63..5....2>...x\|D...ct.Kx..H@b.3..l..#u.....L......^..4.....rP..{.......Q...JT.:Xu>..T./>...oq...........~..@.....lq../.... ..#..".&.8.H$..r...J)..jj...&..f.=.9..N9.....'F..8.4.....m...m...m.m..n..&.X..}....S.\|.....n........PHaE...J...4..MjJ.*..nW)..rn3'/.....ks5zY5c...Mgg.5..p..rR{c...p..t\.8.c=..p...X.(.......7....=.........!...H ........(.0...(.q.JT?.b..z].'T...m..vNi.....t....:P.R..H....t.........&?.:.j.51+.S.":j.SK'I.^....}S.i.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\KFOjCnqEu92Fr1Mu51TjASc6CsI[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 22204, version 1.1
Category:	downloaded
Size (bytes):	22204
Entropy (8bit):	7.9742393611260916
Encrypted:	false
SSDEEP:	384:X4RPU21exwpjqNUdgwvWwW9i5ZTkudHjv3vQWsdV8bT3XV6qvihHbF9qW8Y:XsPN1eae2SwvWr2TkuDvvQWc8bT3XARH
MD5:	4DF32891A5F2F98A363314F595482E08
SHA1:	A8AB4E03143BCF7646C96A8CB33B3E596A9E55BD
SHA-256:	0BE0AE6EFD852B3695CB7A76286096F60E93B7D31C16E0B71CA35ECED7FDE8F6
SHA-512:	3C1775EE5F2D42B53C4196280D11E3405B9EEAEEFF1FDF8291E7D87D7748D28BBCB1ECD7A225AD266144EAB28ADE08A7EB4659824B2FA649884B86B1783EF2ED
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/roboto/v20/KFOjCnqEu92Fr1Mu51TjASc6CsI.woff
Preview:	wOFF......V........l........................GDEF.......G...d....GPOS................GSUB.......'......r.OS/2.......N...`t6.<cmap...$..........W.cvt .......X...X/...fpgm...t...4......".gasp................glyf......B...s.._{hdmx..O....m........head..P....6...6...mhhea..P8..."...$...nhmtx..P\.........FIloca..R..........b'maxp..T.... ... .(..name..T...........>.post..U........ .a.dprep..U........?.1 .x...1..P......PB..U.=l.@..B)..w.......Y.e.u.m.C.s...x.h.~R....R...A.J.x.l..h.a........l.m.6.1+.X....i...y....&...._..63..5....2>...x\|D...ct.Kx..H@b.3..l..#u.....L......^..4.....rP..{.......Q...JT.:Xu>..T./>...oq...........~..@.....lq../.... ..#..".&.8.H$..r...J)..jj...&..f.=.9..N9.....'F..8.4.....m...m...m.m..n..&.X..}....S.\|.....n........PHaE...J...4..MjJ...nW)..rn3'/.....ks5zY5c...Mgg.5..p..rR{c...p..t\.8.c=..p...X.(.......7....=.........!...H ........(.0...(.q.JT?.b..z].'T...m..vNi.....t....:P.R..H....t.........&?.:.j.51+.S.":j.SK'I.^....}S.i.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\KFOkCnqEu92Fr1Mu51xIIzQ[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 21952, version 1.1
Category:	downloaded
Size (bytes):	21952
Entropy (8bit):	7.970421989516302
Encrypted:	false
SSDEEP:	384:LANJRPUW1egrkV1qAeQjd3pHH7fS3SIHwip3fzp7IYMa8/h3ELZ2owoRE1F:LAN/Pl1egR7QjRp+3SIHwcLpMYC/h+9U
MD5:	FE65B8335EE19DD944289F9ED3178C78
SHA1:	E9E842D5ED5321DDD719599057E9F8643B2AD539
SHA-256:	80815EFE3BD9317C666DF0F2E6D701335E178954F64EB1E99103FEA81C2AA137
SHA-512:	6E7995EDEBAEF0218C921F5485CDA2B1FDCCFDC9ED5CF988AA005096BB64BC844CFA9F3CE081CFB5A8C896492BD5D70CA2B4D7B71EE9A9EE801A721F9F45B087
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/roboto/v20/KFOkCnqEu92Fr1Mu51xIIzQ.woff
Preview:	wOFF......U........\|........................GDEF.......G...d....GPOS................GSUB.......'......r.OS/2.......O...`t..Rcmap...$..........W.cvt .......R...R..-.fpgm...p...4....s...gasp................glyf......A...q^...Phdmx..N....m........head..O....6...6...ehhea..O8..."...$....hmtx..O\...v.....}?.loca..Q.........E.'.maxp..S.... ... .(..name..S...........:.post..T........ .a.dprep..T........D..].x...1..P......PB..U.=l.@..B)..w.......Y.e.u.m.C.s...x.h.~R....R...A.J.x.l..h.a........l.m.6.1+.X....i...y....&...._..63..5....2>...x\|D...ct.Kx..H@b.3..l..#u.....L......^..4.....rP..{.......Q...JT.:Xu>..T./>...oq...........~..@.....lq../.... ..#..".&.8.H$..r...J)..jj...&..f.=.9..N9.....'F..8.4.....m...m...m.m..n..&.X..}....S.\|.....n........PHaE...J...4..MjJ.*..nW)..rn3'/.....ks5zY5c...Mgg.5..p..rR{c...p..t\.8.c=..p...X.(.......7....=.........!...H ........(.0...(.q.JT?.b..z].'T...m..vNi.....t....:P.R..H....t.........&?.:.j.51+.S.":j.SK'I.^....}S.i.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\Mini-Brush-Set-Demo-1-600x600[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 600x600, frames 3
Category:	downloaded
Size (bytes):	26761
Entropy (8bit):	7.941780838605892
Encrypted:	false
SSDEEP:	768:RDxc/OS8F3sMcVIuocSQu9Mseqj/IZQ92qXwRo:RDxhOdauovQu9g+/kkpw6
MD5:	2521B5F7DC8D93A85ECB25934E574175
SHA1:	279EC7C03F9419FDA92FD0B96CBC0E6C7A5501EB
SHA-256:	F67DF7BAF1B124BBE5DDDF4DD17741DD536AF68FF825AFC26511CFA367EA2329
SHA-512:	8A8EFD9F6FF6B1744F231A717BFCB30092EF52AA10A12567D4F0D5A92F69FBDFA815A0F33D7B8B08926E7D588902617D97278E3AD7D2DF33E687E6E46D7CB9A1
Malicious:	false
Reputation:	low
IE Cache URL:	https://theragcompany.de/wp-content/uploads/2020/05/Mini-Brush-Set-Demo-1-600x600.jpg
Preview:	......JFIF.............C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$......X.X.."...............................................................................eG......$.r..'&wt.Q..s..X%.yn..P.^.....Im...~K..=..m.>/{..S........c..FH.S'G..j.ni..y.p.0.$........2...9lqsQ.u...s..$../..^..s..9q.u,.J.<..;.=/=j.Uvm\...8..t...y.......T.\.......w..L....g.....2.j....JvK.%<...Mlx+......d...#d..5..(.",....y.!:....m5n.V ....Nc.....G~..oc......6..oW..b..o.W-q...u..\...J_[..]L^..).....`..&.X...Y.j.P..F1..k.Y.F...$#@..0M.(.[.y..N..SW,...D.q.....o..uH..N/.....n7.....?&..[....{.]<......1.9.A..9[E.v.S.N.T..>.[.....Vn.:..V.@[..e..6N0VI$.E.2Pr"M,X. ba$...;.&.F.\....X..\|.U...^..g..qW...d{...n...Mb..d.s.=.[.w1}.l.....s.....P.u.W.l.-])p..c8i.d^W+....B...d.Q$...m..6......!}%I.sb`.6..p.v..,..5.c@.>...O5d..Y.b^...q....u..J.....M9.....T`..T.=.{.......I....G!#.?L.5..$......X7.J*.:.u..

Static File Info

No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 23, 2021 17:25:27.517118931 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:27.517959118 CET	49713	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:27.565808058 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:27.565974951 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:27.566098928 CET	443	49713	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:27.566160917 CET	49713	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:27.573940039 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:27.574791908 CET	49713	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:27.637242079 CET	443	49713	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:27.637254953 CET	443	49713	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:27.637269974 CET	443	49713	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:27.637401104 CET	49713	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:27.642374039 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:27.642410994 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:27.642429113 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:27.642479897 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:27.642530918 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:27.673185110 CET	49713	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:27.673297882 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:27.679922104 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:27.680047035 CET	49713	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:27.680084944 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:27.722709894 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:27.722735882 CET	443	49713	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:27.722805023 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:27.722860098 CET	49713	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:27.728717089 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:27.728748083 CET	443	49713	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:27.728856087 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:27.728908062 CET	49713	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:27.729058027 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:27.729223013 CET	49713	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:27.769608974 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:27.778227091 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:27.818105936 CET	443	49713	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:31.855319023 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:31.855350971 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:31.855370998 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:31.855387926 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:31.855405092 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:31.855422974 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:31.855439901 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:31.855448008 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:31.855463028 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:31.855504990 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:32.075702906 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:32.076004028 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:32.076273918 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:32.076546907 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:32.117110014 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:32.117398024 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:32.124330997 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:32.124351978 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:32.124492884 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:32.124737978 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:32.126216888 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:32.126236916 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:32.126296997 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:32.126353979 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:32.126374006 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:32.126391888 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:32.126410961 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:32.126430035 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:32.126444101 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:32.126471043 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:32.126498938 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:32.126508951 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:32.126527071 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:32.126545906 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:32.126554966 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:32.126573086 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:32.126595974 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:32.167484045 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:32.176656961 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:32.176681042 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:32.176692963 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:32.176709890 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:32.176731110 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:32.176743984 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:32.176765919 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:32.176784992 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:32.176794052 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:32.176811934 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:32.176827908 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:32.176840067 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:32.176856995 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:32.176871061 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:32.176886082 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:32.176898956 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:32.176913977 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:32.176938057 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:32.176944017 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:32.176959038 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:32.176971912 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:32.176980972 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:32.176999092 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:32.177009106 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:32.177028894 CET	443	49712	185.104.28.118	192.168.2.3
Feb 23, 2021 17:25:32.177045107 CET	49712	443	192.168.2.3	185.104.28.118
Feb 23, 2021 17:25:32.177057028 CET	443	49712	185.104.28.118	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 23, 2021 17:25:18.622600079 CET	64938	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:18.684817076 CET	53	64938	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:18.988451004 CET	60152	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:19.039809942 CET	53	60152	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:20.143132925 CET	57544	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:20.202888012 CET	53	57544	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:21.357191086 CET	55984	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:21.419641972 CET	53	55984	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:22.429685116 CET	64185	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:22.480359077 CET	53	64185	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:23.386801958 CET	65110	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:23.438412905 CET	53	65110	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:24.548274040 CET	58361	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:24.596955061 CET	53	58361	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:25.430022001 CET	63492	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:25.487179995 CET	53	63492	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:26.244683027 CET	60831	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:26.303483009 CET	53	60831	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:26.567100048 CET	60100	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:26.618262053 CET	53	60100	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:27.430972099 CET	53195	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:27.507757902 CET	53	53195	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:27.586637020 CET	50141	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:27.637209892 CET	53	50141	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:28.482434034 CET	53023	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:28.532886982 CET	53	53023	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:29.600660086 CET	49563	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:29.653444052 CET	53	49563	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:30.382148981 CET	51352	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:30.444344044 CET	53	51352	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:32.083002090 CET	59349	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:32.122821093 CET	57084	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:32.148123026 CET	53	59349	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:32.185683966 CET	53	57084	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:33.327092886 CET	58823	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:33.381234884 CET	57568	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:33.384287119 CET	53	58823	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:33.430851936 CET	53	57568	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:34.713105917 CET	50540	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:34.761851072 CET	53	50540	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:35.499783039 CET	54366	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:35.558346987 CET	53	54366	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:36.340050936 CET	53034	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:36.399591923 CET	53	53034	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:37.335524082 CET	57762	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:37.396210909 CET	53	57762	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:51.922378063 CET	55435	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:51.984251022 CET	53	55435	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:55.487332106 CET	50713	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:55.549838066 CET	53	50713	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:55.864577055 CET	56132	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:55.925688982 CET	53	56132	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:56.584000111 CET	58987	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:56.659631968 CET	53	58987	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:56.685705900 CET	56579	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:56.749201059 CET	53	56579	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:56.999464989 CET	60633	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:57.063755035 CET	53	60633	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:57.436954021 CET	61292	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:57.487345934 CET	53	61292	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:57.521404028 CET	63619	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:57.579925060 CET	53	63619	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:57.822779894 CET	58987	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:57.883068085 CET	53	58987	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:58.010123968 CET	60633	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:58.071753025 CET	53	60633	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:58.118145943 CET	64938	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:58.179445982 CET	53	64938	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:58.819737911 CET	58987	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:58.832386971 CET	61946	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:58.885355949 CET	53	58987	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:58.893254995 CET	53	61946	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:59.015547037 CET	60633	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:59.067078114 CET	53	60633	8.8.8.8	192.168.2.3
Feb 23, 2021 17:25:59.137578964 CET	64910	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:25:59.196578026 CET	53	64910	8.8.8.8	192.168.2.3
Feb 23, 2021 17:26:00.830899000 CET	52123	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:26:00.831711054 CET	58987	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:26:00.881804943 CET	53	52123	8.8.8.8	192.168.2.3
Feb 23, 2021 17:26:00.894053936 CET	53	58987	8.8.8.8	192.168.2.3
Feb 23, 2021 17:26:01.025808096 CET	60633	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:26:01.085768938 CET	53	60633	8.8.8.8	192.168.2.3
Feb 23, 2021 17:26:01.331312895 CET	56130	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:26:01.393455029 CET	53	56130	8.8.8.8	192.168.2.3
Feb 23, 2021 17:26:04.839577913 CET	58987	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:26:04.900079012 CET	53	58987	8.8.8.8	192.168.2.3
Feb 23, 2021 17:26:05.041678905 CET	60633	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:26:05.085896969 CET	56338	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:26:05.103600025 CET	53	60633	8.8.8.8	192.168.2.3
Feb 23, 2021 17:26:05.134578943 CET	53	56338	8.8.8.8	192.168.2.3
Feb 23, 2021 17:26:05.321058035 CET	59420	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:26:05.381485939 CET	53	59420	8.8.8.8	192.168.2.3
Feb 23, 2021 17:26:05.628025055 CET	58784	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:26:05.631100893 CET	63978	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:26:05.695350885 CET	53	58784	8.8.8.8	192.168.2.3
Feb 23, 2021 17:26:05.701205969 CET	53	63978	8.8.8.8	192.168.2.3
Feb 23, 2021 17:26:07.066298008 CET	62938	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:26:07.127072096 CET	53	62938	8.8.8.8	192.168.2.3
Feb 23, 2021 17:26:14.305466890 CET	55708	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:26:14.364928961 CET	53	55708	8.8.8.8	192.168.2.3
Feb 23, 2021 17:26:41.687815905 CET	56803	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:26:41.692516088 CET	57145	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:26:41.745570898 CET	53	57145	8.8.8.8	192.168.2.3
Feb 23, 2021 17:26:41.754795074 CET	53	56803	8.8.8.8	192.168.2.3
Feb 23, 2021 17:26:43.157438040 CET	55359	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:26:43.217329025 CET	53	55359	8.8.8.8	192.168.2.3
Feb 23, 2021 17:26:43.976584911 CET	58306	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:26:44.028029919 CET	53	58306	8.8.8.8	192.168.2.3
Feb 23, 2021 17:26:48.558214903 CET	64124	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:26:48.625411034 CET	53	64124	8.8.8.8	192.168.2.3
Feb 23, 2021 17:26:48.914314985 CET	49361	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:26:48.996023893 CET	53	49361	8.8.8.8	192.168.2.3
Feb 23, 2021 17:26:55.303658009 CET	63150	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:26:55.354341030 CET	53	63150	8.8.8.8	192.168.2.3
Feb 23, 2021 17:27:23.944920063 CET	53279	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:27:23.964870930 CET	56881	53	192.168.2.3	8.8.8.8
Feb 23, 2021 17:27:24.015752077 CET	53	53279	8.8.8.8	192.168.2.3
Feb 23, 2021 17:27:24.021826029 CET	53	56881	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Feb 23, 2021 17:25:27.430972099 CET	192.168.2.3	8.8.8.8	0x3e7a	Standard query (0)	theragcompany.de	A (IP address)	IN (0x0001)
Feb 23, 2021 17:25:32.122821093 CET	192.168.2.3	8.8.8.8	0x1d50	Standard query (0)	www.theragcompany.de	A (IP address)	IN (0x0001)
Feb 23, 2021 17:25:51.922378063 CET	192.168.2.3	8.8.8.8	0xe0a8	Standard query (0)	theragcompany.de	A (IP address)	IN (0x0001)
Feb 23, 2021 17:25:55.864577055 CET	192.168.2.3	8.8.8.8	0x4789	Standard query (0)	www.facebook.com	A (IP address)	IN (0x0001)
Feb 23, 2021 17:25:56.685705900 CET	192.168.2.3	8.8.8.8	0xd122	Standard query (0)	m.facebook.com	A (IP address)	IN (0x0001)
Feb 23, 2021 17:25:57.436954021 CET	192.168.2.3	8.8.8.8	0xc1f	Standard query (0)	static.xx.fbcdn.net	A (IP address)	IN (0x0001)
Feb 23, 2021 17:25:57.521404028 CET	192.168.2.3	8.8.8.8	0xd5c9	Standard query (0)	facebook.com	A (IP address)	IN (0x0001)
Feb 23, 2021 17:25:58.118145943 CET	192.168.2.3	8.8.8.8	0xc666	Standard query (0)	fbcdn.net	A (IP address)	IN (0x0001)
Feb 23, 2021 17:25:58.832386971 CET	192.168.2.3	8.8.8.8	0x7c57	Standard query (0)	fbsbx.com	A (IP address)	IN (0x0001)
Feb 23, 2021 17:25:59.137578964 CET	192.168.2.3	8.8.8.8	0xf224	Standard query (0)	scontent.xx.fbcdn.net	A (IP address)	IN (0x0001)
Feb 23, 2021 17:26:00.830899000 CET	192.168.2.3	8.8.8.8	0xe053	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)
Feb 23, 2021 17:26:01.331312895 CET	192.168.2.3	8.8.8.8	0x311e	Standard query (0)	abs.twimg.com	A (IP address)	IN (0x0001)
Feb 23, 2021 17:26:05.321058035 CET	192.168.2.3	8.8.8.8	0xf8fd	Standard query (0)	scontent-frx5-1.xx.fbcdn.net	A (IP address)	IN (0x0001)
Feb 23, 2021 17:26:05.628025055 CET	192.168.2.3	8.8.8.8	0xf4e1	Standard query (0)	external-frt3-2.xx.fbcdn.net	A (IP address)	IN (0x0001)
Feb 23, 2021 17:26:05.631100893 CET	192.168.2.3	8.8.8.8	0xb196	Standard query (0)	scontent-frt3-2.xx.fbcdn.net	A (IP address)	IN (0x0001)
Feb 23, 2021 17:26:07.066298008 CET	192.168.2.3	8.8.8.8	0xc70b	Standard query (0)	www.instagram.com	A (IP address)	IN (0x0001)
Feb 23, 2021 17:26:41.687815905 CET	192.168.2.3	8.8.8.8	0xa314	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Feb 23, 2021 17:26:41.692516088 CET	192.168.2.3	8.8.8.8	0x4600	Standard query (0)	open.spotify.com	A (IP address)	IN (0x0001)
Feb 23, 2021 17:26:43.157438040 CET	192.168.2.3	8.8.8.8	0x89b2	Standard query (0)	open.scdn.co	A (IP address)	IN (0x0001)
Feb 23, 2021 17:26:43.976584911 CET	192.168.2.3	8.8.8.8	0x8f04	Standard query (0)	i.scdn.co	A (IP address)	IN (0x0001)
Feb 23, 2021 17:26:48.558214903 CET	192.168.2.3	8.8.8.8	0xafca	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)
Feb 23, 2021 17:26:48.914314985 CET	192.168.2.3	8.8.8.8	0x869d	Standard query (0)	static.doubleclick.net	A (IP address)	IN (0x0001)
Feb 23, 2021 17:27:23.944920063 CET	192.168.2.3	8.8.8.8	0x5756	Standard query (0)	yt3.ggpht.com	A (IP address)	IN (0x0001)
Feb 23, 2021 17:27:23.964870930 CET	192.168.2.3	8.8.8.8	0x710a	Standard query (0)	i.ytimg.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Feb 23, 2021 17:25:27.507757902 CET	8.8.8.8	192.168.2.3	0x3e7a	No error (0)	theragcompany.de		185.104.28.118	A (IP address)	IN (0x0001)
Feb 23, 2021 17:25:32.185683966 CET	8.8.8.8	192.168.2.3	0x1d50	No error (0)	www.theragcompany.de		185.104.28.118	A (IP address)	IN (0x0001)
Feb 23, 2021 17:25:51.984251022 CET	8.8.8.8	192.168.2.3	0xe0a8	No error (0)	theragcompany.de		185.104.28.118	A (IP address)	IN (0x0001)
Feb 23, 2021 17:25:55.925688982 CET	8.8.8.8	192.168.2.3	0x4789	No error (0)	www.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)
Feb 23, 2021 17:25:55.925688982 CET	8.8.8.8	192.168.2.3	0x4789	No error (0)	star-mini.c10r.facebook.com		31.13.92.36	A (IP address)	IN (0x0001)
Feb 23, 2021 17:25:56.749201059 CET	8.8.8.8	192.168.2.3	0xd122	No error (0)	m.facebook.com	star-mini.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)
Feb 23, 2021 17:25:56.749201059 CET	8.8.8.8	192.168.2.3	0xd122	No error (0)	star-mini.c10r.facebook.com		31.13.92.36	A (IP address)	IN (0x0001)
Feb 23, 2021 17:25:57.487345934 CET	8.8.8.8	192.168.2.3	0xc1f	No error (0)	static.xx.fbcdn.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)
Feb 23, 2021 17:25:57.487345934 CET	8.8.8.8	192.168.2.3	0xc1f	No error (0)	scontent.xx.fbcdn.net		157.240.27.27	A (IP address)	IN (0x0001)
Feb 23, 2021 17:25:57.579925060 CET	8.8.8.8	192.168.2.3	0xd5c9	No error (0)	facebook.com		31.13.92.36	A (IP address)	IN (0x0001)
Feb 23, 2021 17:25:58.179445982 CET	8.8.8.8	192.168.2.3	0xc666	No error (0)	fbcdn.net		31.13.92.36	A (IP address)	IN (0x0001)
Feb 23, 2021 17:25:58.893254995 CET	8.8.8.8	192.168.2.3	0x7c57	No error (0)	fbsbx.com		31.13.92.36	A (IP address)	IN (0x0001)
Feb 23, 2021 17:25:59.196578026 CET	8.8.8.8	192.168.2.3	0xf224	No error (0)	scontent.xx.fbcdn.net		31.13.92.14	A (IP address)	IN (0x0001)
Feb 23, 2021 17:26:00.881804943 CET	8.8.8.8	192.168.2.3	0xe053	No error (0)	twitter.com		104.244.42.193	A (IP address)	IN (0x0001)
Feb 23, 2021 17:26:00.881804943 CET	8.8.8.8	192.168.2.3	0xe053	No error (0)	twitter.com		104.244.42.1	A (IP address)	IN (0x0001)
Feb 23, 2021 17:26:01.393455029 CET	8.8.8.8	192.168.2.3	0x311e	No error (0)	abs.twimg.com	cs510.wpc.edgecastcdn.net		CNAME (Canonical name)	IN (0x0001)
Feb 23, 2021 17:26:01.393455029 CET	8.8.8.8	192.168.2.3	0x311e	No error (0)	cs510.wpc.edgecastcdn.net		152.199.21.141	A (IP address)	IN (0x0001)
Feb 23, 2021 17:26:05.381485939 CET	8.8.8.8	192.168.2.3	0xf8fd	No error (0)	scontent-frx5-1.xx.fbcdn.net		185.60.216.19	A (IP address)	IN (0x0001)
Feb 23, 2021 17:26:05.695350885 CET	8.8.8.8	192.168.2.3	0xf4e1	No error (0)	external-frt3-2.xx.fbcdn.net	scontent-frt3-2.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)
Feb 23, 2021 17:26:05.695350885 CET	8.8.8.8	192.168.2.3	0xf4e1	No error (0)	scontent-frt3-2.xx.fbcdn.net		157.240.20.19	A (IP address)	IN (0x0001)
Feb 23, 2021 17:26:05.701205969 CET	8.8.8.8	192.168.2.3	0xb196	No error (0)	scontent-frt3-2.xx.fbcdn.net		157.240.20.19	A (IP address)	IN (0x0001)
Feb 23, 2021 17:26:07.127072096 CET	8.8.8.8	192.168.2.3	0xc70b	No error (0)	www.instagram.com	z-p42-instagram.c10r.facebook.com		CNAME (Canonical name)	IN (0x0001)
Feb 23, 2021 17:26:07.127072096 CET	8.8.8.8	192.168.2.3	0xc70b	No error (0)	z-p42-instagram.c10r.facebook.com		31.13.92.174	A (IP address)	IN (0x0001)
Feb 23, 2021 17:26:41.745570898 CET	8.8.8.8	192.168.2.3	0x4600	No error (0)	open.spotify.com	edge-web-split-geo.dual-gslb.spotify.com		CNAME (Canonical name)	IN (0x0001)
Feb 23, 2021 17:26:41.745570898 CET	8.8.8.8	192.168.2.3	0x4600	No error (0)	edge-web-split-geo.dual-gslb.spotify.com		35.186.224.25	A (IP address)	IN (0x0001)
Feb 23, 2021 17:26:41.754795074 CET	8.8.8.8	192.168.2.3	0xa314	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Feb 23, 2021 17:26:43.217329025 CET	8.8.8.8	192.168.2.3	0x89b2	No error (0)	open.scdn.co	scdnco.spotify.map.fastly.net		CNAME (Canonical name)	IN (0x0001)
Feb 23, 2021 17:26:43.217329025 CET	8.8.8.8	192.168.2.3	0x89b2	No error (0)	scdnco.spotify.map.fastly.net		199.232.138.248	A (IP address)	IN (0x0001)
Feb 23, 2021 17:26:44.028029919 CET	8.8.8.8	192.168.2.3	0x8f04	No error (0)	i.scdn.co	scdnco.spotify.map.fastly.net		CNAME (Canonical name)	IN (0x0001)
Feb 23, 2021 17:26:44.028029919 CET	8.8.8.8	192.168.2.3	0x8f04	No error (0)	scdnco.spotify.map.fastly.net		199.232.138.248	A (IP address)	IN (0x0001)
Feb 23, 2021 17:26:48.625411034 CET	8.8.8.8	192.168.2.3	0xafca	No error (0)	googleads.g.doubleclick.net		142.250.186.162	A (IP address)	IN (0x0001)
Feb 23, 2021 17:26:48.996023893 CET	8.8.8.8	192.168.2.3	0x869d	No error (0)	static.doubleclick.net	static-doubleclick-net.l.google.com		CNAME (Canonical name)	IN (0x0001)
Feb 23, 2021 17:27:24.015752077 CET	8.8.8.8	192.168.2.3	0x5756	No error (0)	yt3.ggpht.com	photos-ugc.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Feb 23, 2021 17:27:24.015752077 CET	8.8.8.8	192.168.2.3	0x5756	No error (0)	photos-ugc.l.googleusercontent.com		142.250.186.65	A (IP address)	IN (0x0001)
Feb 23, 2021 17:27:24.021826029 CET	8.8.8.8	192.168.2.3	0x710a	No error (0)	i.ytimg.com		172.217.16.150	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Feb 23, 2021 17:25:27.637269974 CET	185.104.28.118	443	192.168.2.3	49713	CN=theragcompany.de CN=R3, O=Let's Encrypt, C=US	CN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Tue Feb 23 14:50:37 CET 2021 Wed Oct 07 21:21:40 CEST 2020	Mon May 24 15:50:37 CEST 2021 Wed Sep 29 21:21:40 CEST 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:27.637269974 CET	185.104.28.118	443	192.168.2.3	49713	CN=R3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Oct 07 21:21:40 CEST 2020	Wed Sep 29 21:21:40 CEST 2021		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:27.642429113 CET	185.104.28.118	443	192.168.2.3	49712	CN=theragcompany.de CN=R3, O=Let's Encrypt, C=US	CN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Tue Feb 23 14:50:37 CET 2021 Wed Oct 07 21:21:40 CEST 2020	Mon May 24 15:50:37 CEST 2021 Wed Sep 29 21:21:40 CEST 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:27.642429113 CET	185.104.28.118	443	192.168.2.3	49712	CN=R3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Oct 07 21:21:40 CEST 2020	Wed Sep 29 21:21:40 CEST 2021		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:32.352936029 CET	185.104.28.118	443	192.168.2.3	49721	CN=theragcompany.de CN=R3, O=Let's Encrypt, C=US	CN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Tue Feb 23 14:50:37 CET 2021 Wed Oct 07 21:21:40 CEST 2020	Mon May 24 15:50:37 CEST 2021 Wed Sep 29 21:21:40 CEST 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:32.352936029 CET	185.104.28.118	443	192.168.2.3	49721	CN=R3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Oct 07 21:21:40 CEST 2020	Wed Sep 29 21:21:40 CEST 2021		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:32.503376007 CET	185.104.28.118	443	192.168.2.3	49720	CN=theragcompany.de CN=R3, O=Let's Encrypt, C=US	CN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Tue Feb 23 14:50:37 CET 2021 Wed Oct 07 21:21:40 CEST 2020	Mon May 24 15:50:37 CEST 2021 Wed Sep 29 21:21:40 CEST 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:32.503376007 CET	185.104.28.118	443	192.168.2.3	49720	CN=R3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Oct 07 21:21:40 CEST 2020	Wed Sep 29 21:21:40 CEST 2021		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:52.099582911 CET	185.104.28.118	443	192.168.2.3	49733	CN=theragcompany.de CN=R3, O=Let's Encrypt, C=US	CN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Tue Feb 23 14:50:37 CET 2021 Wed Oct 07 21:21:40 CEST 2020	Mon May 24 15:50:37 CEST 2021 Wed Sep 29 21:21:40 CEST 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	37f463bf4616ecd445d4a1937da06e19
Feb 23, 2021 17:25:52.099582911 CET	185.104.28.118	443	192.168.2.3	49733	CN=R3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Oct 07 21:21:40 CEST 2020	Wed Sep 29 21:21:40 CEST 2021		37f463bf4616ecd445d4a1937da06e19
Feb 23, 2021 17:25:56.010752916 CET	31.13.92.36	443	192.168.2.3	49738	CN=*.facebook.com, O="Facebook, Inc.", L=Menlo Park, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Feb 10 01:00:00 CET 2021 Tue Oct 22 14:00:00 CEST 2013	Tue May 11 01:59:59 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:56.010752916 CET	31.13.92.36	443	192.168.2.3	49738	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:56.012382030 CET	31.13.92.36	443	192.168.2.3	49739	CN=*.facebook.com, O="Facebook, Inc.", L=Menlo Park, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Feb 10 01:00:00 CET 2021 Tue Oct 22 14:00:00 CEST 2013	Tue May 11 01:59:59 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:56.012382030 CET	31.13.92.36	443	192.168.2.3	49739	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:57.064759016 CET	31.13.92.36	443	192.168.2.3	49740	CN=*.facebook.com, O="Facebook, Inc.", L=Menlo Park, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Feb 10 01:00:00 CET 2021 Tue Oct 22 14:00:00 CEST 2013	Tue May 11 01:59:59 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:57.064759016 CET	31.13.92.36	443	192.168.2.3	49740	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:57.067189932 CET	31.13.92.36	443	192.168.2.3	49741	CN=*.facebook.com, O="Facebook, Inc.", L=Menlo Park, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Feb 10 01:00:00 CET 2021 Tue Oct 22 14:00:00 CEST 2013	Tue May 11 01:59:59 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:57.067189932 CET	31.13.92.36	443	192.168.2.3	49741	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:57.725260019 CET	157.240.27.27	443	192.168.2.3	49743	CN=*.facebook.com, O="Facebook, Inc.", L=Menlo Park, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Feb 10 01:00:00 CET 2021 Tue Oct 22 14:00:00 CEST 2013	Tue May 11 01:59:59 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:57.725260019 CET	157.240.27.27	443	192.168.2.3	49743	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:57.726255894 CET	157.240.27.27	443	192.168.2.3	49742	CN=*.facebook.com, O="Facebook, Inc.", L=Menlo Park, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Feb 10 01:00:00 CET 2021 Tue Oct 22 14:00:00 CEST 2013	Tue May 11 01:59:59 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:57.726255894 CET	157.240.27.27	443	192.168.2.3	49742	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:57.726303101 CET	157.240.27.27	443	192.168.2.3	49746	CN=*.facebook.com, O="Facebook, Inc.", L=Menlo Park, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Feb 10 01:00:00 CET 2021 Tue Oct 22 14:00:00 CEST 2013	Tue May 11 01:59:59 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:57.726303101 CET	157.240.27.27	443	192.168.2.3	49746	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:57.726433039 CET	157.240.27.27	443	192.168.2.3	49744	CN=*.facebook.com, O="Facebook, Inc.", L=Menlo Park, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Feb 10 01:00:00 CET 2021 Tue Oct 22 14:00:00 CEST 2013	Tue May 11 01:59:59 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:57.726433039 CET	157.240.27.27	443	192.168.2.3	49744	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:57.726773024 CET	157.240.27.27	443	192.168.2.3	49745	CN=*.facebook.com, O="Facebook, Inc.", L=Menlo Park, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Feb 10 01:00:00 CET 2021 Tue Oct 22 14:00:00 CEST 2013	Tue May 11 01:59:59 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:57.726773024 CET	157.240.27.27	443	192.168.2.3	49745	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:57.727312088 CET	157.240.27.27	443	192.168.2.3	49747	CN=*.facebook.com, O="Facebook, Inc.", L=Menlo Park, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Feb 10 01:00:00 CET 2021 Tue Oct 22 14:00:00 CEST 2013	Tue May 11 01:59:59 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:57.727312088 CET	157.240.27.27	443	192.168.2.3	49747	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:57.837213993 CET	31.13.92.36	443	192.168.2.3	49749	CN=*.facebook.com, O="Facebook, Inc.", L=Menlo Park, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Feb 10 01:00:00 CET 2021 Tue Oct 22 14:00:00 CEST 2013	Tue May 11 01:59:59 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:57.837213993 CET	31.13.92.36	443	192.168.2.3	49749	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:57.871542931 CET	31.13.92.36	443	192.168.2.3	49748	CN=*.facebook.com, O="Facebook, Inc.", L=Menlo Park, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Feb 10 01:00:00 CET 2021 Tue Oct 22 14:00:00 CEST 2013	Tue May 11 01:59:59 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:57.871542931 CET	31.13.92.36	443	192.168.2.3	49748	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:58.495634079 CET	31.13.92.36	443	192.168.2.3	49751	CN=fbcdn.net, O="Facebook, Inc.", L=Menlo Park, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Sun Feb 07 01:00:00 CET 2021 Tue Oct 22 14:00:00 CEST 2013	Sat May 08 01:59:59 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:58.495634079 CET	31.13.92.36	443	192.168.2.3	49751	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:58.577331066 CET	31.13.92.36	443	192.168.2.3	49750	CN=fbcdn.net, O="Facebook, Inc.", L=Menlo Park, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Sun Feb 07 01:00:00 CET 2021 Tue Oct 22 14:00:00 CEST 2013	Sat May 08 01:59:59 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:58.577331066 CET	31.13.92.36	443	192.168.2.3	49750	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:59.009567022 CET	31.13.92.36	443	192.168.2.3	49752	CN=fbcdn.net, O="Facebook, Inc.", L=Menlo Park, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Sun Feb 07 01:00:00 CET 2021 Tue Oct 22 14:00:00 CEST 2013	Sat May 08 01:59:59 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	3faf2df7ab96c36419c31725cb1fa7d6
Feb 23, 2021 17:25:59.009567022 CET	31.13.92.36	443	192.168.2.3	49752	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		3faf2df7ab96c36419c31725cb1fa7d6
Feb 23, 2021 17:25:59.018290043 CET	31.13.92.36	443	192.168.2.3	49753	CN=fbcdn.net, O="Facebook, Inc.", L=Menlo Park, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Sun Feb 07 01:00:00 CET 2021 Tue Oct 22 14:00:00 CEST 2013	Sat May 08 01:59:59 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	3faf2df7ab96c36419c31725cb1fa7d6
Feb 23, 2021 17:25:59.018290043 CET	31.13.92.36	443	192.168.2.3	49753	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		3faf2df7ab96c36419c31725cb1fa7d6
Feb 23, 2021 17:25:59.491797924 CET	31.13.92.14	443	192.168.2.3	49755	CN=*.facebook.com, O="Facebook, Inc.", L=Menlo Park, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Feb 10 01:00:00 CET 2021 Tue Oct 22 14:00:00 CEST 2013	Tue May 11 01:59:59 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:59.491797924 CET	31.13.92.14	443	192.168.2.3	49755	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:59.491848946 CET	31.13.92.14	443	192.168.2.3	49754	CN=*.facebook.com, O="Facebook, Inc.", L=Menlo Park, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Feb 10 01:00:00 CET 2021 Tue Oct 22 14:00:00 CEST 2013	Tue May 11 01:59:59 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:25:59.491848946 CET	31.13.92.14	443	192.168.2.3	49754	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:26:00.999489069 CET	104.244.42.193	443	192.168.2.3	49756	CN=twitter.com, OU=lon3, O="Twitter, Inc.", L=San Francisco, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Mar 26 01:00:00 CET 2020 Tue Oct 22 14:00:00 CEST 2013	Thu Mar 25 13:00:00 CET 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:26:00.999489069 CET	104.244.42.193	443	192.168.2.3	49756	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:26:01.007291079 CET	104.244.42.193	443	192.168.2.3	49757	CN=twitter.com, OU=lon3, O="Twitter, Inc.", L=San Francisco, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Mar 26 01:00:00 CET 2020 Tue Oct 22 14:00:00 CEST 2013	Thu Mar 25 13:00:00 CET 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:26:01.007291079 CET	104.244.42.193	443	192.168.2.3	49757	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:26:01.493671894 CET	152.199.21.141	443	192.168.2.3	49759	CN=*.twimg.com, O="Twitter, Inc.", L=San Francisco, ST=California, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Nov 05 01:00:00 CET 2020 Thu Sep 24 02:00:00 CEST 2020	Wed Nov 10 00:59:59 CET 2021 Tue Sep 24 01:59:59 CEST 2030	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:26:01.493671894 CET	152.199.21.141	443	192.168.2.3	49759	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 24 02:00:00 CEST 2020	Tue Sep 24 01:59:59 CEST 2030		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:26:01.493738890 CET	152.199.21.141	443	192.168.2.3	49760	CN=*.twimg.com, O="Twitter, Inc.", L=San Francisco, ST=California, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Nov 05 01:00:00 CET 2020 Thu Sep 24 02:00:00 CEST 2020	Wed Nov 10 00:59:59 CET 2021 Tue Sep 24 01:59:59 CEST 2030	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:26:01.493738890 CET	152.199.21.141	443	192.168.2.3	49760	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 24 02:00:00 CEST 2020	Tue Sep 24 01:59:59 CEST 2030		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:26:01.495107889 CET	152.199.21.141	443	192.168.2.3	49761	CN=*.twimg.com, O="Twitter, Inc.", L=San Francisco, ST=California, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Nov 05 01:00:00 CET 2020 Thu Sep 24 02:00:00 CEST 2020	Wed Nov 10 00:59:59 CET 2021 Tue Sep 24 01:59:59 CEST 2030	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:26:01.495107889 CET	152.199.21.141	443	192.168.2.3	49761	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 24 02:00:00 CEST 2020	Tue Sep 24 01:59:59 CEST 2030		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:26:01.497608900 CET	152.199.21.141	443	192.168.2.3	49758	CN=*.twimg.com, O="Twitter, Inc.", L=San Francisco, ST=California, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Nov 05 01:00:00 CET 2020 Thu Sep 24 02:00:00 CEST 2020	Wed Nov 10 00:59:59 CET 2021 Tue Sep 24 01:59:59 CEST 2030	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:26:01.497608900 CET	152.199.21.141	443	192.168.2.3	49758	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 24 02:00:00 CEST 2020	Tue Sep 24 01:59:59 CEST 2030		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:26:05.471978903 CET	185.60.216.19	443	192.168.2.3	49762	CN=*.facebook.com, O="Facebook, Inc.", L=Menlo Park, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Feb 10 01:00:00 CET 2021 Tue Oct 22 14:00:00 CEST 2013	Tue May 11 01:59:59 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:26:05.471978903 CET	185.60.216.19	443	192.168.2.3	49762	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:26:05.472137928 CET	185.60.216.19	443	192.168.2.3	49763	CN=*.facebook.com, O="Facebook, Inc.", L=Menlo Park, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Feb 10 01:00:00 CET 2021 Tue Oct 22 14:00:00 CEST 2013	Tue May 11 01:59:59 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:26:05.472137928 CET	185.60.216.19	443	192.168.2.3	49763	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:26:05.823354006 CET	157.240.20.19	443	192.168.2.3	49765	CN=*.facebook.com, O="Facebook, Inc.", L=Menlo Park, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Feb 10 01:00:00 CET 2021 Tue Oct 22 14:00:00 CEST 2013	Tue May 11 01:59:59 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:26:05.823354006 CET	157.240.20.19	443	192.168.2.3	49765	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:26:05.824445009 CET	157.240.20.19	443	192.168.2.3	49766	CN=*.facebook.com, O="Facebook, Inc.", L=Menlo Park, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Feb 10 01:00:00 CET 2021 Tue Oct 22 14:00:00 CEST 2013	Tue May 11 01:59:59 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:26:05.824445009 CET	157.240.20.19	443	192.168.2.3	49766	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:26:05.826854944 CET	157.240.20.19	443	192.168.2.3	49767	CN=*.facebook.com, O="Facebook, Inc.", L=Menlo Park, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Feb 10 01:00:00 CET 2021 Tue Oct 22 14:00:00 CEST 2013	Tue May 11 01:59:59 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:26:05.826854944 CET	157.240.20.19	443	192.168.2.3	49767	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:26:05.827270031 CET	157.240.20.19	443	192.168.2.3	49764	CN=*.facebook.com, O="Facebook, Inc.", L=Menlo Park, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Feb 10 01:00:00 CET 2021 Tue Oct 22 14:00:00 CEST 2013	Tue May 11 01:59:59 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:26:05.827270031 CET	157.240.20.19	443	192.168.2.3	49764	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:26:07.227267027 CET	31.13.92.174	443	192.168.2.3	49771	CN=*.www.instagram.com, O="Facebook, Inc.", L=Menlo Park, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Jan 13 01:00:00 CET 2021 Tue Oct 22 14:00:00 CEST 2013	Tue Apr 13 01:59:59 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:26:07.227267027 CET	31.13.92.174	443	192.168.2.3	49771	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:26:07.241694927 CET	31.13.92.174	443	192.168.2.3	49770	CN=*.www.instagram.com, O="Facebook, Inc.", L=Menlo Park, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Jan 13 01:00:00 CET 2021 Tue Oct 22 14:00:00 CEST 2013	Tue Apr 13 01:59:59 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Feb 23, 2021 17:26:07.241694927 CET	31.13.92.174	443	192.168.2.3	49770	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: iexplore.exe PID: 1288 Parent PID: 792

General

Start time:	17:25:24
Start date:	23/02/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff7ae280000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: iexplore.exe PID: 5460 Parent PID: 1288

General

Start time:	17:25:25
Start date:	23/02/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:1288 CREDAT:17410 /prefetch:2
Imagebase:	0x90000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Disassembly

Reset < >

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Network device logs, Network intrusion detection system, Packet capture, Process use of network, SSL/TLS inspection, Web proxy
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report https://theragcompany.de/shaming.php

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Sigma Overview

Signature Overview

Phishing:

Compliance:

Networking:

System Summary:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

No static file info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTPS Packets

Code Manipulations

Statistics

Behavior

System Behavior

Analysis Process: iexplore.exe PID: 1288 Parent PID: 792

General

Analysis Process: iexplore.exe PID: 5460 Parent PID: 1288

General

Disassembly